The Linux kernel’s Bluetooth ISO subsystem suffers a race condition where the hci_conn::iso_data field is accessed concurrently without proper locking, causing a use‑after‑free. Based on the description, it is inferred that the UAF may lead to a kernel crash or other integrity loss if the freed memory is accessed before deallocation is complete.

All Linux kernel builds that enable Bluetooth ISO and have not applied commit 876a3e94c70d0859d1dad1c986112d4f0d99eba8 are affected. The advisory does not specify exact kernel versions, so any earlier release not containing the fix is considered vulnerable. Distribution or build differences do not alter the affected scope.

The EPSS score is less than 1%, indicating a very low but nonzero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker could trigger the race by sending crafted Bluetooth ISO traffic, potentially leading to a kernel panic or abrupt system shutdown. The CVSS score of 8.8 classifies this as high severity, suggesting that exploitation could result in denial of service or compromise if other kernel paths are involved. Exploitation requires local access to Bluetooth ISO functionality, and no elevated privileges are explicitly required.