The flaw occurs in the Linux kernel Bluetooth mesh management code. When a mesh transmission is cancelled, the related mesh_tx object is freed, yet a command queued on the sync work list still holds a raw pointer to that freed object. If the cleanup of that queued command later accesses the pointer, a use‑after‑free condition is triggered. This can corrupt kernel memory and may allow an attacker to execute arbitrary code with kernel privileges or crash the system. The vulnerability is exploited through the Bluetooth management interface, likely by sending mesh commands and then cancelling them; the attack path is inferred from the description of send_cancel() and mesh_next().

All Linux kernel variants, as identified by the kernel vendor and the generic Linux CPE, are affected until the patch is applied. The exact versions prior to the fix are not enumerated in the advisory, so any kernel build shipped before the fix is potentially vulnerable.

The CVSS score of 4.1 indicates moderate severity, and the EPSS score is reported to be below 1%, suggesting a low likelihood of immediate exploitation. However, because the flaw results in a use‑after‑free in kernel space, an attacker who can drive the vulnerable Bluetooth mesh interface could potentially gain local privilege escalation or cause a denial of service. The vulnerability is not currently listed in the CISA KEV catalog.