The vulnerability resides in the Linux kernel’s Bluetooth RFCOMM implementation. A use‑after‑free occurs when rfcomm_security_cfm() traverses a session’s DLC list without holding rfcomm_mutex, allowing a concurrent session teardown to free the same objects. The result is kernel memory corruption that can trigger a crash through KASAN or an unvalidated use of freed pointers. This defect in some environments, provide exploitation potential. The weakness is cataloged as CWE‑825.

Affected systems are Linux kernel distributions that include the Bluetooth RFCOMM stack. The CPE indicates ‘kernel:linux_kernel’ and the vendor list reports only Linux, so all kernel versions prior to the applied fix are vulnerable. No specific exists in any kernel build that has not been patched by the kernel maintainer.

The CVSS score is 4.8, reflecting a moderate severity. EPSS indicates a very low exploitation probability (<1%). The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through the Bluetooth interface, requiring a client that can invoke the security confirmation flow to trigger the race condition. While the exploit requires a concurrent teardown, the absence of a publicly documented exploit reduces immediate risk, but the kernel can still be destabilized. Consequently, the overall risk remains moderate, with a higher priority for systems exposed to Bluetooth traffic.