The vulnerability resides in the Linux kernel’s Bluetooth implementation. When a Bluetooth device is closed, the kernel releases an internal lock before clearing the local codec list. Although other operations such as BT_CODEC queries acquire the same lock to read the list, the close path does not, creating a race. A concurrent BT_CODEC query can therefore read freed memory after the list entries are deallocated. This use‑after‑free error manifests as KASAN reports and can lead to corruption of kernel data structures, potentially allowing code execution or a system crash. The weakness corresponds to classic use‑after‑free bugs.

All Linux kernel builds that include the vulnerable Bluetooth stack are affected, regardless of vendor. No specific version numbers are provided, so any kernel that has not yet applied the patch is potentially vulnerable.

The CVSS score of 7.0 indicates high severity. The EPSS score is under 1 %, suggesting a low probability that attackers will target this flaw. The vulnerability is not listed in the CISA KEV catalog, further indicating limited exploitation activity. The race condition can be triggered by a local attacker who can issue a close operation on a Bluetooth device followed by a BT_CODEC ioctl request. If successful, the use‑after‑free could corrupt kernel memory, allowing privilege escalation or denial of service, depending on what the freed memory is used for. However, because the condition requires local interaction and the exploitation window is narrow, the overall risk remains moderate.