The Linux Bluetooth stack contained an improper reference‑counting bug that allowed Bluetooth ISO channel connection objects to be released while still in use. This mismatch can lead to use‑after‑free conditions, potentially corrupting kernel memory and escalating privileges or causing a kernel panic. The flaw was discovered in hci_bind_cis() and hci_connect_cis(), where the hold on a CIS (Connected Isochronous Stream) was not taken before a configuration failure or an early return, breaking the documented ownership contract.

All Linux kernel releases that include the Bluetooth file hci_conn.c before the hot‑fix commit are affected. The update applies to the general Linux kernel source tree and does not target a specific distribution; any kernel compiled from the mainline before the fix may be vulnerable.

The CVSS score is not supplied, and the EPSS score is unavailable; it is not listed in the CISA KEV catalog. The vulnerability does not pose a known immediate threat, yet exploitation would likely require a crafted Bluetooth packet transmitted from a nearby device or from a device with which the target has data exchange. The bug could enable denial of service or kernel compromise if successfully triggered. Patching mitigates all risks. Until a patch is applied, the risk remains theoretical but non‑negligible for exposed systems.