The vulnerability originates from the Linux kernel’s Bluetooth L2CAP implementation, where a reconfiguration request on an already connected channel re‑initializes ERTM data structures without freeing prior allocations, leading to memory leaks of all previously allocated resources. Additionally, a missing validation of the remote maximum packet size allows a zero value to propagate into the segmentation routine, causing an infinite loop that consumes all available memory. An attacker who can trigger repeated reconfiguration or provide malformed configuration values could exhaust system memory or cause the kernel to hang, resulting in denial of service.

This issue affects the Linux kernel itself, specifically the Bluetooth L2CAP subsystem in all kernel releases that include the affected code paths. The exact kernel versions are not enumerated in the supplied data, but any kernel with the L2CAP reconfiguration logic will be impacted. Since the CNA list lists Linux:Linux, users running any Linux kernel distribution with the stock Bluetooth stack should consider this vulnerability.

The CVSS score is not provided, and EPSS is not available, so the precise exploitation likelihood cannot be quantified. The vulnerability is listed in the kernel source as a regression fix but is not currently in the CISA KEV catalog. If an attacker can induce the kernel to process a configuration request with a zero remote MPS value, the infinite loop can be triggered, though practical exploitation would require some form of privileged or elevated Bluetooth interaction. The presence of a memory leak adds a secondary persistence risk. Administrators should not assume negligible impact; until the kernel is updated, the system could suffer a denial of service.