The vulnerability is a race condition in the Linux kernel Bluetooth L2CAP stack. It arises when a channel is in the process of being connected or bound, allowing a second __l2cap_chan_add call before the first operation completes. This violates the invariant that a channel may be linked to a connection at most once, potentially causing the kernel to crash or exhibit undefined behaviour. The lack of proper locking and state checks means the bug could be triggered by local processes that create and bind Bluetooth sockets in a time‑sensitive manner. The impact is primarily a denial‑of‑service, as the kernel crash would bring down the entire system, but it does not directly provide code execution or elevated privileges.

All Linux kernel releases that contain the vulnerable Bluetooth L2CAP implementation are affected. No specific kernel versions are listed, so any system running a recent kernel with Bluetooth support should be considered potentially vulnerable until a fix is applied via the Linux kernel update channel.

The CVSS score of 7.8 indicates a Medium‑High severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local, achieved by a malicious or compromised user space application that interacts with the Bluetooth stack. The race condition requires careful timing, so exploitation is non‑trivial but feasible on systems where high concurrency of Bluetooth socket operations is possible. Until the patch is installed, the kernel may crash, leading to service disruption.