The kernel fails to hold the socket lock when accessing iso_pi(sk)->conn inside iso_sock_getname, creating a race condition that can allow an attacker to read or modify kernel memory. This flaw undermines the integrity of the Bluetooth ISO stack and could result in memory corruption or a kernel crash if exploited. The vulnerability stems from incorrect locking of a shared socket structure, a classic concurrency weakness.

All Linux kernels running an unpatched implementation of iso_sock_getname are affected. The specific versions are not listed, so any distribution that has not applied the upstream patch that adds the missing lock remains at risk. Systems exposing the Bluetooth ISO layer are the primary target.

The missing lock allows a race condition that requires precise timing on Bluetooth ISO traffic. Based on the description, an attacker could issue crafted packets over a Bluetooth connection to trigger the race, potentially leading to a denial‑of‑service or memory corruption. The EPSS score of <1% and absence from the CISA KEV catalog suggest limited public exploitation. Nevertheless, the concurrent nature of the bug means it can be exploited by a local or remote attacker with Bluetooth access, raising the risk of kernel instability or privilege escalation if an exploit is crafted.