The kernel flaw occurs when the function hci_enhanced_setup_sync executes on a request workqueue without holding the hci_dev_lock mutex. This allows a concurrent disconnection handler to unlink and free the parent ACL connection while the SCO child continues to dereference the parent pointer, resulting in a use‑after‑free condition. The affected kernel code can corrupt memory or trigger a kernel panic; based on the description it is inferred that the resulting use‑after‑free could be leveraged for privilege escalation or arbitrary code execution, but this is not explicitly stated in the CVE description.

The vulnerability resides in the Linux kernel’s Bluetooth subsystem. Any distribution shipping a kernel that does not include commit 42de40abe25d, which protects the parent reference, remains vulnerable. The flaw affects all builds where this lock guard is missing, regardless of distribution or release date.

The EPSS score indicates a very low exploitation probability, as it falls below 1%; the CVSS score of 4.7 places the severity in the medium range, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers could exploit the race by injecting specific Bluetooth packets that trigger the disconnection logic while an SCO session is in progress; however, the requirement for an active SCO session and control over the Bluetooth traffic reduces the likelihood of widespread exploitation. The resulting use‑after‑free could potentially facilitate privilege escalation on systems that accept legacy audio profiles, but this is an inference not stated in the CVE description.