The flaw arises in the Linux kernel Bluetooth ISO stack where the driver copies data from a Periodic Advertisement Report into a BASE buffer only when the service UUID equals the Basic Audio Announcement Service UUID. The copy operation is performed without explicit enforcement of buffer boundaries, which could lead to memory corruption or a denial‑of‑service condition in the kernel should the data exceed the buffer size. This behavior is identified as CWE‑120, representing an unvalidated buffer copy.

The bug is present in the generic Bluetooth ISO driver of the Linux kernel. All Linux kernel releases that include this driver are potentially affected, as the CPE classifies linux_kernel and no specific version range is indicated. Systems that ship a Linux kernel and enable the Bluetooth ISO subsystem are at risk.

The vulnerability scores a CVSS 8.8, indicating high severity. Its EPSS score is listed as < 1%, suggesting a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers could send a crafted Bluetooth advertisement packet containing the Basic Audio Announcement Service UUID to a target Linux host processing ISO traffic, achieving remote exploitation without requiring local privileges.