The iso_sock_timeout() function in the Linux kernel’s Bluetooth ISO stack holds the socket lock while disabling a timer, which can lead to a deadlock and stall the system. When iso_sock_timeout() runs concurrently with iso_conn_del(), a use‑after‑free can occur, freeing a connection context that is still referenced and causing a kernel crash, resulting in a system crash or denial of service. The vulnerability is classified under CWE-825 according to the CNA list.

All Linux kernel versions that contain the buggy iso_sock_timeout logic before the patch commits (e.g., before commits 16d89a63, 200fa162, 3c3d5f85, or 82e982f5) are vulnerable. Distributions based on those kernels are affected unless they have applied the patch or upgraded past these commits.

The CVSS score of 8.8 indicates high severity. The EPSS score is below 1%, implying a low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting no large‑scale attacks have been reported. Based on the description, it is inferred that the likely attack vector involves a race condition triggered by Bluetooth traffic, which could allow an attacker to cause a kernel crash and a denial‑of‑service outcome.