The bug manifests when detaching a Bluetooth ISO connection; the iso_data pointer is not cleared, causing iso_conn_free to dereference freed memory. Based on the description, it is inferred that an attacker with local control of the Bluetooth stack or with sufficient privileges could trigger this sequence of detach events, potentially leading to kernel memory corruption, privilege escalation, or denial of service due to the use‑after‑free flaw.

This issue affects the Linux kernel’s Bluetooth ISO implementation. No specific kernel release numbers are listed in the data, so any kernel build that has not applied the patch will be vulnerable.

The condition is a kernel‑level use‑after‑free that could allow an attacker with access to the Bluetooth driver to crash the system or execute arbitrary code. The CVSS score of 8.8 indicates high severity. The EPSS score is <1%, indicating a very low probability of exploitation, and the issue is not listed in KEV. As the attack vector is inferred to be through manipulation of ISO connection detachment, the exploit would likely require local or privileged access to the Bluetooth subsystem rather than a remote surface.