The vulnerability arises in the Linux kernel's Bluetooth ISO implementation, where certain channel attach operations fail to release an unused hold. The hold is a reference count that, if not released, contributes to a leaked resource. Over time, the persistent hold may lead to increased memory usage or other resource exhaustion, potentially causing a denial of service or destabilizing the kernel.

This issue affects Linux kernel versions that contain the unpatched Bluetooth ISO handling. The specific affected release lines are not enumerated, so any kernel deployment that includes this code path should be considered at risk until the patch is applied.

The exploit will exercise the Bluetooth stack, creating channel associates that are not cleaned up. The likely attack vector is through remote or local Bluetooth communication, as the bug is triggered by hci_connect_cis calls via incoming Bluetooth traffic. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Without an official CVSS score, the severity assessment remains uncertain, but the potential for resource exhaustion indicates a non‑trivial risk.