A race condition between the Bluetooth LE passive scan setup workqueue and the command workqueue can cause a use‑after‑free of an sk_buff in the Linux kernel’s Bluetooth subsystem. The pointer used by hci_sent_cmd_data is borrowed from a packet buffer that may be freed by another workqueue before it is dereferenced, as reported by KASAN. If an attacker can repeatedly trigger or manipulate the scan synchronization, the resulting memory corruption could lead to a kernel panic or gain of arbitrary code execution at privilege level.

The flaw affects the Linux kernel’s Bluetooth implementation. Any Linux kernel release prior to the patch that includes the vulnerable hci_le_set_ext_scan_param_sync and related functions is susceptible. The specific affected versions are not enumerated in the advisory, so all kernels with the unfixed code may be impacted. The vulnerability is relevant to all Linux devices that enable Bluetooth, including desktop, embedded, and mobile systems.

The CVSS score of 7.8 marks the vulnerability as high severity, yet the EPSS score of <1% indicates a low probability of exploitation at present. The flaw is not listed in the CISA KEV catalog, implying there are no widespread active attacks recorded. The likely attack vector is a remote Bluetooth device that can initiate passive scan synchronization, reproducing the race condition. While exploitation would require precise timing, the nature of the bug (use‑after‑free) makes a successful attack potentially catastrophic for the host kernel.