Linux Kernel EUVD-2026-59723

Exploitation requires the attacker to be within Bluetooth radio range of a target system running an unpatched Linux kernel with Bluetooth enabled and Bluetooth LE Audio BIG (Broadcast Isochronous Group) support active - this requires Bluetooth 5.2+ capable hardware and a kernel compiled with relevant BT LE Audio support. No prior authentication or existing session is required per the CVSS PR:N rating. The vulnerability is constrained by: (1) physical proximity to within Bluetooth radio range; (2) the requirement to win a kernel race condition with a narrow timing window, described as 'theoretical' by the upstream commit author; (3) BT 5.2+ hardware presence on the target; and (4) the target's Bluetooth stack must be powered on and accepting connection attempts. Non-default or recent Bluetooth LE Audio hardware requirements limit the realistic exposure surface compared to classic Bluetooth vulnerabilities.

The NVD-assigned CVSS of 8.8 (AV:A/AC:L/PR:N/UI:N/C:H/I:H/A:H) reflects Bluetooth adjacency and no required authentication, with full CIA impact from a kernel-level UAF. However, AC:L appears generous: the description explicitly labels this a 'theoretical UAF,' implying the race window between conn free and callback execution may be narrow and difficult to reliably trigger without targeted timing research. An independent assessment of AC:H is more appropriate. EPSS at 0.15% (5th percentile) confirms very low current exploitation probability, and the vulnerability is absent from CISA KEV, with no POC identified. Even a mid-sized municipal IT team in gniezno would reasonably classify this as a standard patch-cycle item rather than an emergency response. The high theoretical CIA impact is valid for kernel UAF class vulnerabilities - if the race is won, arbitrary kernel-context code execution is plausible - but the combination of adjacency-only vector, timing-dependent race, and no public exploit tempers real-world urgency significantly.

An attacker within Bluetooth radio range (typically up to 100m for Class 1 adapters) sends a sequence of Bluetooth LE Audio BIG connection requests timed to create a race condition where the kernel frees the conn struct while hci_connect_big_sync()'s callback is still queued. If the race window is successfully closed, the callback dereferences freed kernel memory, potentially corrupting heap metadata or function pointers to redirect kernel execution. No public exploit code exists, and the narrow timing dependency makes reliable exploitation require significant targeted research.