The vulnerability is a race condition in the Linux kernel’s Bluetooth management code. During asynchronous controller setup the count of unconfigured controllers is obtained, the buffer is allocated, and then the device flags are checked again while filling the response. Because the per‑device flag changes are not serialised by the lock, a controller can become eligible for the fill step after the allocation pass, causing an out‑of‑bounds write to the response array. Such memory corruption can lead to a kernel crash or arbitrary code execution, potentially compromising the entire system. Based solely on the description, the primary impact is to the confidentiality, integrity, and availability of the affected host.

All kernels of the Linux operating system that implement the Bluetooth mgmt interface are affected. No specific versions are listed in the advisory; the issue exists in any kernel that has the pre‑patch implementation of read_unconf_index_list. The vendor is Linux and the product is the Linux kernel.

The vulnerability has not been assigned an EPSS score or listed in CISA’s KEV catalogue, so its current exploitation probability is unknown. However, the nature of the flaw – an out‑of‑bounds write leading to potential code execution – suggests a high severity CVSS if it existed. The likely attack vector is via the Bluetooth mgmt interface, which may be reachable locally or remotely depending on system configuration. Attackers could trigger the race by initiating controller setup or by flooding mgmt requests while a controller is in an intermediate state.