In the Linux kernel btusb driver a use‑after‑free can occur when a USB Bluetooth device is disconnected while its receive work is still running. Disconnecting frees the btusb_data structure, yet the pending rx_work continues to execute and dereferences the freed memory, resulting in a kernel crash or, if an attacker can influence the contents of that memory before it is reused, arbitrary code execution with kernel privileges.

All Linux kernel distributions that ship the btusb driver before the patch commit (1c12c3117639e789) are affected. The flaw applies to any host that loads the btusb module to service a USB Bluetooth adapter, regardless of vendor.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of <1% shows a low exploitation probability and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need local access to a system with a USB Bluetooth adapter and the ability to trigger a disconnect while traffic is in flight. Exploitation would likely cause a kernel crash, and could permit privilege escalation if the attacker can control the memory reused after the free. The flaw requires local interaction and is not remotely exploitable.