The Linux kernel Bluetooth management code allowed a race condition when the local name was set asynchronously on powered BR/EDR controllers. While rebuilding extended inquiry response (EIR) data, the code walked a list of pending commands without holding the appropriate lock and did not treat the set‑local‑name operation as an EIR‑affecting command. This could cause a pending command to be removed and freed while still being inspected, producing a use‑after‑free. The flaw could be abused to corrupt kernel memory, crash the system or, in the worst case, achieve code execution with kernel privileges. This flaw is a use‑after‑free race identified as CWE-366.

All Linux kernel variants that contain the Bluetooth management subsystem prior to the inclusion of the fix are affected, as identified by the Linux:Linux vendor entry. The specific affected versions are not listed in the data, but the patch was applied in a recent kernel release and applies to all earlier releases that use the same management code flow. System administrators should verify if their kernel contains the bug rather than rely on a version list.

The EPSS score is less than 1% and the vulnerability is not listed in CISA KEV, so publicly known exploitation data is lacking. The CVSS score of 7.8 indicates high severity for this kernel‑level use‑after‑free, and the race can be triggered by normal Bluetooth operations. The likely attack vector is local to the device; an attacker that can influence the Bluetooth local name or UUID list—such as a malicious nearby device or a compromised user—could exploit the race. Given the absence of exploitation reports, the overall exploitability might be moderate to high, but the impact remains severe due to privileged kernel access.