The vulnerability is a race condition in the Linux kernel’s Bluetooth management code. During asynchronous controller setup the count of unconfigured controllers is obtained, the buffer is allocated, and then the device flags are checked again while filling the response. Because the per‑device flag changes are not serialised by the lock, a controller can become eligible for the fill step after the allocation pass, causing an out‑of‑bounds write to the response array. Such memory corruption can lead to a kernel crash or arbitrary code execution, potentially compromising the entire system.

All kernels of the Linux operating system that implement the Bluetooth mgmt interface are affected. No specific versions are listed in the advisory; the issue exists in any kernel that has the pre‑patch implementation of read_unconf_index_list. The vendor is Linux and the product is the Linux kernel.

The CVSS score is 7. The EPSS score is <1% and the vulnerability is not listed in CISA’s KEV catalog. The out‑of‑bounds write can lead to kernel memory corruption, potentially causing a crash or arbitrary code execution. The likely attack vector is via the Bluetooth mgmt interface, which may be reachable locally or remotely depending on system configuration. Attackers could trigger the race by initiating controller setup or by flooding mgmt requests while a controller is in an intermediate state.