During the Bluetooth pairing process, the kernel's management layer fulfills pending pair commands and handles pairing completion or authentication failures. In the affected code, the callback functions locate a pending pair operation while holding a lock, but a concurrent cancellation request can remove and free the same pending command before the callback releases the lock. This race leads to a use‑after‑free condition that can corrupt memory and, in the right circumstances, allow an attacker to execute arbitrary code within the kernel. The weakness is a classic Use‑After‑Free scenario (CWE‑825).

The vulnerability resides in the Linux kernel's Bluetooth management subsystem. All Linux kernel versions that have not applied the patch implementing mgmt_pending_lock protection in mgmt: pair command handling are potentially affected. This includes every distribution that ships the default kernel with Bluetooth support until the fix is integrated.

The CVSS score is 7.8, EPSS < 1%, KEV not listed, so the exact exploitation probability is unknown. However, the presence of a kernel use‑after‑free that can lead to arbitrary code execution gives the vulnerability a high severity posture. Based on the description it is inferred that an attacker would need a malicious Bluetooth device or local user control of the Bluetooth controller to trigger the race condition; physical proximity or legal access to the device is likely required. Once exploited, the attacker can gain kernel privileges and compromise the entire host. The risk remains significant until the kernel patch is applied.