The vulnerability arises in the Linux kernel's Bluetooth SCO implementation, where a socket (sk) is dereferenced without holding the required lock or reference count, creating a use‑after‑free when a concurrent close occurs. This race condition can lead to a kernel crash or privilege escalation if an attacker can trigger the faulty path via a crafted Bluetooth connection. The primary weakness is a use‑after‑free flaw (CWE‑416).

All Linux kernel versions that include the unpatched Bluetooth SCO code are affected, regardless of distribution, as the CNAs list indicates Linux:Linux with no specific version constraints. Any system running the default kernel with Bluetooth enabled is potentially vulnerable.

The exploit requires a malicious Bluetooth device to engage in an SCO connection that races with a simultaneous socket close. While a local or remote attacker with Bluetooth visibility can trigger the race, the concurrent close condition means the threat remains opportunistic. No public exploit is known and the EPSS score is unavailable, suggesting low exploitation probability; however, the function can cause a kernel panic, potentially enabling privilege escalation. The vulnerability is not listed in the CISA KEV catalog.