The flaw is a use‑after‑free condition in the Linux kernel’s Bluetooth HCI synchronization module. When a Bluetooth connection is torn down while its hci_sync task is still running, the connection object can be freed prematurely, allowing attackers to corrupt kernel memory. This could enable privilege escalation from a local attacker if the race condition is triggered, and, if Bluetooth is exposed to untrusted networks, there is a potential for remote exploitation as well.

All Linux kernel releases that implement the hci_sync module without the ref‑count guard are impacted. Any kernel build prior to the commit that adds the guard (c53c70ec) is considered vulnerable; the vulnerability applies to all distributions with those kernel versions.

The CVSS score of 7.8 signals high severity, while the EPSS score of <1% indicates a very low but non‑zero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker could send crafted Bluetooth packets that initiate a synchronization while the connection is being closed, potentially triggering the race condition. If Bluetooth services are accessible from untrusted networks, this could raise the attack vector to remote, but the description does not explicitly confirm that scenario.