The flaw occurs in the Linux kernel Bluetooth mesh management code. When a mesh transmission is cancelled, the related mesh_tx object is freed, but a command queued on the sync work list still holds a raw pointer to the freed object. If the cleanup of that queued command later accesses the pointer, a use‑after‑free condition is triggered. This can corrupt kernel memory and may enable an attacker to execute arbitrary code with kernel privileges or crash the system. The vulnerability is exploited through the Bluetooth management interface, likely by sending mesh commands and then cancelling them; the attack path is inferred from the description of send_cancel() and mesh_next().

All Linux kernel variants, as identified by the kernel vendor and the generic Linux CPE, are affected until the patch is applied. The exact versions prior to the fix are not enumerated in the advisory, so any kernel build shipped before the fix is potentially vulnerable.

The security impact is high, owing to the potential for arbitrary code execution in kernel space. No CVSS score is presented in the advisory, and the EPSS score is not available; the vulnerability is not listed in the CISA KEV catalog. Because the flaw relies on a race condition between cancellation and queued work processing, attackers must be able to interact with the Bluetooth stack, which may be remotely accessible on devices exposing the mgmt interface. The exploit is therefore observable, though precise execution complexity is not specified in the advisory.