The vulnerability arises in the Linux kernel's Bluetooth ISO implementation, where certain channel attach operations fail to release an unused hold. The hold is a reference count that, if not released, contributes to a leaked resource. Over time, the persistent hold may lead to increased memory usage or other resource exhaustion, potentially causing a denial of service or destabilizing the kernel.

This issue affects Linux kernel versions that contain the unpatched Bluetooth ISO handling. The specific affected release lines are not enumerated, so any kernel deployment that includes this code path should be considered at risk until the patch is applied.

The exploit will exercise the Bluetooth stack, creating channel associates that are not cleaned up. The likely attack vector is through remote or local Bluetooth communication, as the bug is triggered by hci_connect_cis calls via incoming Bluetooth traffic. The EPSS score is < 1%, indicating a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 3.3 indicates a low severity, but the potential for resource exhaustion still marks it as a non‑trivial risk.