A race between iso_conn_del() and iso_chan_del() allows the reference counter for an iso_conn object to be decremented twice, bringing it below zero. This underflow frees the object while it remains reachable, creating a use‑after‑free in kernel space. The flaw is specific to the Bluetooth ISO subsystem of the Linux kernel and was discovered in the refcounting logic for iso_conn during channel addition failures.

All Linux kernel builds that include the Bluetooth ISO device driver are affected. The vendor list identifies Linux kernel as the impacted product; no specific release numbers are enumerated, so any kernel released before the patch commits remains vulnerable.

The CVSS score of 8.8 classifies this as a high‑severity flaw. The EPSS score of <1% indicates that exploitation attempts are statistically unlikely at the present time, and the vulnerability is not listed in the CISA KEV catalog. However, a skilled attacker who can trigger the race—either locally via a privileged process or remotely through a crafted Bluetooth ISO packet—could execute arbitrary code with kernel privileges. The attack vector is inferred to be Bluetooth ISO traffic or local configuration manipulation, based on the nature of the affected subsystem.