The Linux kernel’s Bluetooth hci_core module contained a race condition in the device registration path. During hci_register_dev(), the power_on work item was queued before the msft extension’s mutex was initialized. When a device with the HCI_QUIRK_RAW_DEVICE flag is registered, hci_power_on runs concurrently on another CPU and calls hci_dev_do_close(). If msft_do_close() executes before msft_register() finishes initializing the mutex, a DEBUG_LOCKS warning is triggered on an uninitialized lock and, if pressed further, could lead to a kernel panic. Based on the description, it is inferred that an attacker could trigger the race by introducing a Bluetooth device that sets the HCI_QUIRK_RAW_DEVICE flag, causing the driver to attempt configuration concurrently with the power_on work item. This flaw does not directly disclose data but can precipitate a kernel crash, resulting in a denial of service.

All releases of the Linux kernel that incorporated the buggy Bluetooth hci_core implementation before the fix are impacted. No specific version range is listed in the advisory, so any kernel build prior to the patch may be vulnerable. Users running standard kernel packages should verify that the kernel has been updated to the patched branch.

The flaw is catalogued in the official kernel advisory, but it is not listed in CISA’s KEV database, and its EPSS score is below 1%, indicating a very low publicly observable exploitation probability. The CVSS score of 4.7 reflects a moderate impact. The likely attack vector is a Bluetooth-based local or remote threat that triggers device registration and induces the race. Based on the description, it is inferred that an attacker could force the affected kernel to crash by pairing a malicious Bluetooth device that triggers the HCI_QUIRK_RAW_DEVICE flag, thereby executing the uninitialized mutex logic.