The vulnerability resides in the hci_sync subsystem of the Linux kernel. A race condition between the function that updates the HCI event filter and the device removal routine causes the accept list entry to be freed while the controller is still waiting for a response. This use‑after‑free allows an attacker to trigger memory corruption by creating or removing Bluetooth devices while the system is suspending, potentially leading to a crash or an exploitation of the freed memory area.

All Linux kernel builds for which the hci_sync code is present are affected, regardless of distribution. The Common Platform Enumeration identifies the kernel broadly as cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*.*

The vulnerability is a classic use‑after‑free (CWE‑416). No public exploitation or proof‑of‑concept is documented, and the EPSS score is not available, implying a low or uncertain exploit probability. Since the bug occurs in kernel space while the system is suspending, the attack vector is inferred to be local or remote via Bluetooth traffic, but requires the victim device to be in a suspending state. The vulnerability is not listed in the CISA KEV catalog, indicating no known exploited cases. The primary risk is memory corruption that can crash the system or be leveraged for an elevated privilege exploit if additional conditions are met.