In the Linux kernel, the Bluetooth hci_core module allows a connection object to be freed while another workqueue still holds a reference to it. This occurs when the TX worker releases an RCU read lock before completing transmission scheduling, leading hci_abort_conn_sync() to remove the connection. Subsequent accesses by the SCO and ISO schedulers use the freed structure, causing a use‑after‑free that can corrupt kernel memory or allow execution of malicious code. The bug is a classic use‑after‑free (CWE‑416) and therefore can be exploited to gain kernel privilege or perform denial of service.

All Linux kernel releases that include the unpatched hci_core code are affected. The CNA lists Linux:Linux for both vendor and product, meaning any distribution shipping the defective kernel, regardless of vendor, is vulnerable until the kernel is updated to a version incorporating the fix.

The use‑after‑free in the Bluetooth kernel module may lead to arbitrary kernel memory corruption or execution of malicious code in kernel mode. It is triggered when a Bluetooth connection is torn down while the scheduler holds an RCU read lock, allowing the connection structure to be freed and later accessed. An attacker who can manipulate Bluetooth traffic via a nearby device or malicious application could exploit this flaw to elevate privileges or crash the system. The CVSS score is 4.7, the EPSS score is < 1%, and it is not listed in the CISA KEV catalog, indicating moderate severity potential. Because it may not yet have known exploits, the observed KASAN crash demonstrates a real problem. As the failure can be induced through the Bluetooth interface, the likely attack vector is remote over local wireless connectivity.