The fault occurs when the Bluetooth HCI core selects an ACL or LE channel while holding an RCU read lock, then releases the lock before accessing the channel’s connection data. During this interval a disconnect timeout can trigger channel deletion, freeing the channel structure while another process still expects it to exist, resulting in a use‑after‑free. This memory corruption could allow an attacker to cause a crash or execute arbitrary code if the freed memory is reallocated with attacker‑controlled data, impacting the confidentiality, integrity, and availability of the kernel.

Any Linux system running a kernel version that includes the Bluetooth hci_core driver and has Bluetooth enabled may be vulnerable. The advisory does not list a specific kernel release, so it is safest to assume that unpatched kernels with Bluetooth support are at risk.

The CVSS score of 4.7 indicates medium severity; the EPSS score of < 1% shows a very low but nonzero probability of exploitation, and the vulnerability is not in the CISA KEV catalog. The flaw is an use‑after‑free caused by a race between channel scheduling and deletion in the Bluetooth stack. Although the description does not state how an attacker can trigger the race, it is inferred that an attacker with the ability to initiate or interrupt a Bluetooth connection or a disconnect timeout could create the race, making the likely attack vector local or remote via Bluetooth control traffic. No zero‑day exploitation cases have been reported to date.