In the Linux kernel, a reference‑counting logic error in the Bluetooth ISO implementation can cause the parent connection to be disconnected while a socket is still using it. This occurs when hci_bind_bis() obtains a bare pointer to the parent, and a subsequent unlink drops the parent's existing hold. The result is that the kernel may schedule a disconnect of the parent connection while its child socket remains active, which can lead to a kernel panic or service disruption. The flaw is a classic resource‑release bug that compromises kernel stability.

All Linux kernel builds that include Bluetooth ISO support and do not contain the recent commit fixing the parent hold balancing are affected. The exact versions impacted are not enumerated in the CVE data; therefore any system running a kernel before the patch is at risk. Users should check whether their kernel contains the fix revision introduced in the provided Git commits.

Because the bug operates in kernel space, it can potentially result in a denial‑of‑service through a kernel crash. No exploitation probability is published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting a low probability of active exploitation. Nevertheless, the severity of a kernel panic makes this a high‑risk issue that should be remediated promptly. An attacker could trigger the fault by creating or manipulating Bluetooth ISO connections that cause hci_bind_bis() to fail.