An uninitialized use‑after‑free occurs when a Bluetooth connection object is freed while the abort synchronization task is still running. This flaw, identified as CWE-825, arises because the kernel originally did not hold a reference to the connection, creating a theoretical vulnerability that could allow an attacker to corrupt memory or cause a system crash. The flaw is observed when an attacker can trigger a Bluetooth connection abort while an abort handler is running, potentially leading to an exploit of the UAF and compromise of system integrity.

This issue affects the Linux kernel’s Bluetooth stack, specifically the hci_conn subsystem. Any released kernel that has not incorporated the reference‑count fix could be vulnerable. The vendor identified is Linux, and the product is the Linux kernel. No specific kernel release version is listed, so all versions prior to the official fix should be considered potentially affected.

The highest risk is to system integrity; if the UAF is successfully leveraged, it could lead to arbitrary code execution with kernel privileges. The EPSS score is less than 1%, indicating a low probability of exploitation, but the CVSS score of 8.8 denotes a high severity risk. The kernel’s exposure to external Bluetooth traffic and the portable nature of the bug mean that the vulnerability remains a concern.