A concurrency bug in the Linux kernel’s Bluetooth RFCOMM subsystem, identified as CWE‑833, can cause a deadlock when a listener socket is cleaned up, because the child socket lock is released before the worker thread releases the higher‑level rfcomm_mutex. This lock inversion may stall the kernel and disrupt all services that rely on Bluetooth. The likely attack vector is inferred from the description: an attacker could attempt to trigger the race condition by forcing rapid RFCOMM connection attempts, potentially from a malicious Bluetooth device.

The flaw is present in all Linux kernel releases that include the default RFCOMM driver and have not yet applied the patch commits referenced in the advisory. No specific version numbers are listed, but any distribution shipping a kernel built from sources older than the merge of the fix is vulnerable.

The EPSS score of <1% indicates a low but non‑zero probability of exploitation. The CVSS score of 7.5 reflects moderate to high severity. The vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploits. The race condition can cause a kernel deadlock, which would impact all services relying on Bluetooth if an attacker can trigger it. Successful exploitation would likely require access to the target via Bluetooth and a timing window to induce the lock‑inversion race.