In the Linux kernel, a flaw in the L2CAP layer causes the kernel to read memory beyond the bounds of a received L2CAP_INFO_RSP packet when the payload length is insufficient. The implementation only checks the command header size, but then accesses fields in the payload without validating that the required bytes are present. When an attacker sends a truncated packet with a success result, the kernel performs an out‑of‑bounds read of the surrounding skb data. This may expose kernel memory contents or other private data, or potentially lead to a crash. The weakness corresponds to an unchecked array bounds read (CWE‑788).

The vulnerability is present in the Linux kernel code that implements Bluetooth L2CAP support. All distributions that include a Linux kernel version prior to the commit that added the payload length check are affected. No specific version list is provided, but the issue is fixed by the patch referenced in the supplied commit URLs.

The CVSS score is not supplied, and public exploitation data is not available. Exploitation would require an attacker to communicate with the target device over Bluetooth and send a crafted L2CAP_INFO_RSP request. This limits the threat to nearby or connected devices in which Bluetooth is enabled. Because the vulnerability leads only to a read, the likelihood of a successful leak or crash depends on the kernel’s memory layout and the presence of sensitive data adjacent to the buffer. Overall risk is considered moderate, and the priority should be addressed through timely kernel upgrades.