The Linux kernel Bluetooth L2CAP module contains a use‑after‑free bug in the function that handles the LE connection response. The function looks up a channel by identifier but fails to hold a reference before locking or operating on it. A concurrent disconnect can delete the channel, freeing the kernel memory object between the lookup and the lock acquisition. This grants an attacker the opportunity to corrupt memory or execute arbitrary code, potentially leading to a denial of service or a full compromise of the host.

All Linux kernel builds that include support for the Bluetooth L2CAP protocol are affected. The vulnerability is present in any kernel version that implements the Bluetooth LE connection response handling without the recent patch. No precise version range is listed, but the issue exists before the commit referenced in the advisory.

The flaw is an unauthenticated, remote‑side use‑after‑free that can be triggered via the Bluetooth stack. The CVSS score of 8.8 and EPSS score of <1% confirm a high severity but low exploitation probability. An attacker with Bluetooth proximity can initiate or disrupt an L2CAP session to exploit the memory corruption. The vulnerability is not listed in the CISA KEV catalog, but given the potential for code execution, it should be treated as high‑risk and requires prompt remediation.