The Linux kernel’s Bluetooth ISO subsystem implements concurrent connect calls without proper serialization, allowing two callers to bypass initial state checks and alter each other’s socket configuration. This race condition leads to a use‑after‑free in iso_sock_hold, as shown by KASAN reports, which can corrupt kernel memory, trigger a crash, or potentially allow an attacker to execute arbitrary code. The weakness is categorized as CWE‑367, reflecting concurrent access to a shared resource without adequate synchronization.

All Linux kernel installations are potentially affected until the commit that introduces serialization of concurrent ISO socket connect calls is applied. The vulnerability applies across all distributions using the impacted kernel code; no version range is specified in the advisory, so systems using earlier kernels than the patch are considered vulnerable.

The CVSS score of 7.8 classifies the flaw as high severity. The EPSS score of less than 1% indicates a very low but non‑zero likelihood of exploitation at the time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog. Based on the description, the likely attack vector is a remote attacker initiating multiple concurrent Bluetooth ISO connection attempts to trigger the race condition, potentially causing kernel memory corruption, a denial of service, or, if an exploit is crafted, privilege escalation. No publicly documented exploits have been reported yet.