A race condition in the Linux kernel’s Bluetooth RFCOMM driver creates a scenario where two paths can drop the same tty port reference, leading to a use‑after‑free when a later release attempts to reference freed memory. The kernel reports a slab‑use‑after‑free error in tty_port_put, demonstrating that the flaw can cause a kernel memory corruption event. The potential outcome of this fault may be a kernel crash, which would result in an immediate loss of service for the host (inferred from the use‑after‑free nature of KASAN reports).

All Linux kernel releases prior to the RFCOMM_TTY_OWNED race fix are potentially affected. The issue resides in the kernel’s Bluetooth RFCOMM subsystem and applies universally to Linux distributions that ship the unpatched kernel code.

The CVSS score of 4.4 and an EPSS score of less than 1% suggest low overall risk and a low likelihood of exploitation. The vulnerability is not listed in CISA KEV. No publicly available exploits are cited in the provided data; the attack would require manipulating RFCOMM sockets, likely necessitating local privileges or direct control of Bluetooth connections (inferred). At present the risk remains low until a kernel update is applied.