In Linux kernel Bluetooth, the build_pairing_cmd function accesses remote out-of-band data without holding the required device lock. This race condition allows a concurrent remove or clear operation to free the data structure while SMP is still reading it, leading to a use‑after‑free condition that can corrupt memory and potentially allow arbitrary code execution.

The vulnerability affects all Linux kernel versions that include the legacy Bluetooth stack. The affected component is the Bluetooth SMP module, which handles pairing commands that utilize remote OOB data. No specific kernel release is listed, so any installed kernel that has not received the downstream fix is potentially vulnerable.

The CVSS score is 5.1, indicating moderate severity, and the EPSS score is <1%, indicating a low likelihood of exploitation. No public exploit has been reported and the vulnerability is not listed in the CISA KEV catalogue. However, the use‑after‑free race can lead to memory corruption that an attacker could leverage for denial‑of‑service or execution of arbitrary code, especially if the bug is triggered in a privileged context or when the kernel processes incoming Bluetooth traffic from an untrusted device. The lack of a full lock hierarchy means the patch introduces a new per-device mutex to serialise access, reducing the likelihood of successful exploitation.