The Linux Bluetooth stack contained an improper reference‑counting bug that allowed Bluetooth ISO channel connection objects to be released while still in use. This mismatch can lead to use‑after‑free conditions, potentially corrupting kernel memory and escalating privileges or causing a kernel panic. The flaw was discovered in hci_bind_cis() and hci_connect_cis(), where the hold on a CIS (Connected Isochronous Stream) was not taken before a configuration failure or an early return, breaking the documented ownership contract.

All Linux kernel releases that include the Bluetooth file hci_conn.c before the hot‑fix commit are affected. The update applies to the general Linux kernel source tree and does not target a specific distribution; any kernel compiled from the mainline before the fix may be vulnerable.

The CVSS score of 5.5 and an EPSS score of < 1% indicate moderate severity with low exploitation probability. It is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves a malicious Bluetooth device sending a crafted packet to a target host to trigger the reference‑counting bug; the vulnerability does not pose a known immediate threat, but the flaw could lead to denial of service or kernel compromise if successfully exploited. Patching mitigates all risks, and until a patch is applied the risk remains theoretical but non‑negligible for exposed systems.