A race condition in the Linux kernel’s Bluetooth subsystem causes a NULL pointer dereference during device deletion. When a child device is concurrently unregistered while the parent is being reparented, the code attempts to remove a node from a list that has already been cleared, leading to a kernel crash. This denial‑of‑service flaw breaks the integrity of the system’s core device hierarchy, potentially allowing an attacker to disrupt services or cause a complete system reboot. The underlying weakness is a classic NULL pointer dereference and associated use‑after‑free race.

The flaw is present in all Linux kernel releases that contain the affected Bluetooth stack before the commit that introduced the fix. The patch is included in newer kernel versions; any system running an unpatched kernel, regardless of distribution, is potentially vulnerable.

The likely attack vector is local code execution or privilege escalation, inferred from the kernel‑level nature of the defect, but this is not explicitly stated in the CVE payload. No publicly available exploitation tool is documented, and the EPSS score is low (<1%, specifically 0.00166). The vulnerability is not listed as a known exploited vulnerability by CISA. The CVSS score of 7.0 indicates a medium severity flaw and, together with the low EPSS score, suggests that exploitation is unlikely but could still result in a denial‑of‑service outcome. Prompt remediation is important, especially on systems with exposed Bluetooth interfaces.