A use‑after‑free flaw exists in the Linux kernel Bluetooth stack, where a terminated connection structure is inadvertently supplied to a validity check routine. The failure to maintain a reference count allows the memory to be reallocated and later dereferenced, producing a kernel crash. The crash manifests as a denial of service. While the advisory does not confirm arbitrary code execution, a use‑after‑free can be leveraged for privilege escalation in theory.

Linux kernels that contain the original hci_sync handling code are affected. No precise version numbers are supplied; therefore, any distribution shipping an unpatched kernel that includes the vulnerable Bluetooth subsystem is susceptible. Users should verify whether their kernel revision incorporates the fix for hci_sync timing issues.

The severity rating of 8.0 indicates a high impact, yet the EPSS score of less than 1 % signals that exploit prevalence is presently low. The flaw is not listed in CISA KEV, thus no public exploits are documented. The attack vector most likely requires an adversary able to send crafted Bluetooth frames—such as a sync packet or a manipulated connection close—to provoke the faulty callback. This scenario assumes the attacker has the ability to interfere with the target’s Bluetooth link, possibly through proximity or underride of pairing permissions. Given the memory‑reuse requirement of the use‑after‑free, the exploitation difficulty remains high, contributing to the modest EPSS figure.