The Linux Bluetooth implementation contains a race condition where the command-complete handler hci_cc_reset() clears the LE accept and resolving lists without acquiring hdev->lock. If a debugfs reader accesses these lists at the same time, the reader can dereference a freed list entry, leading to a use‑after‑free. This memory corruption can trigger a kernel panic or provide a local privileged attacker an opportunity to gain control of the kernel.

All versions of the Linux kernel that include the defective hci_cc_reset() logic are affected. The precise version range is not specified in the advisory, so any kernel prior to the commit that introduces the hdev->lock around list clears is vulnerable. Users should verify that their kernel has applied the fix incorporated in the referenced patch set.

The vulnerability is local and requires concurrently accessing Bluetooth debugfs files while a reset is being processed. Exploitation would need a privileged user or root to read debugfs, and is non‑trivial due to the race condition. No EPSS score is available and the issue is not listed in the CISA KEV catalog, indicating it is not currently known to be widely exploited, but the potential consequence is significant if it is triggered. The absence of a CVSS score precludes a formal quantitative severity assessment, but the nature of a use‑after‑free in kernel code suggests a high risk if exploited.