The btusb driver maps active SCO links to USB alternate settings through a lookup table that only supports up to three links. The code indexes this table using data->sco_num - 1, and data->sco_num is obtained from hci_conn_num() without being bounded to the table size. Because the table contains only three entries, an unbounded index can read past the end of the array, which may lead to incorrect memory reads and potentially cause the kernel to crash. The description does not indicate any information disclosure beyond a possible kernel failure.

All Linux kernels that ship the buggy btusb driver are affected. The CVE references include Linux kernel 5.8 and all 7.0 release candidates (rc1‑rc7). Any Linux kernel build that includes the unpatched btusb implementation is susceptible.

The CVSS score is 5.5, and the EPSS score is less than 1%, indicating a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The missing bounds check can be triggered by an attacker that initiates multiple SCO links over Bluetooth. While the description only mentions the out‑of‑bounds access, it is inferred that a malicious actor could cause kernel instability by exploiting the unchecked index.