The kernel Bluetooth L2CAP implementation fails to validate the length of an incoming protocol data unit before reading the service data unit length. The routine l2cap_ecred_data_rcv() extracts a 16‑bit length field from the packet buffer without confirming that the buffer contains at least two bytes, which can cause an out‑of‑bounds read of kernel memory. This defect could leak sensitive kernel data to an attacker or trigger an exception that may lead to a crash. The weakness is a classic buffer over‑read (CWE‑125).

Any Linux system whose kernel builds include the Bluetooth L2CAP stack is potentially affected. The patch has been merged into the main Linux kernel tree, but specific affected kernel releases are not listed in the advisory.

The advisory does not provide a CVSS score or EPSS value, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through a Bluetooth connection that can supply crafted L2CAP frames, so an attacker does not need local privileges. Because the flaw allows only a memory read, exploitation may lead to information disclosure or a denial‑of‑service via a crash, making it a serious risk for systems that accept untrusted Bluetooth traffic. The absence of a known exploit does not reduce the need to patch, as the vulnerability’s existence alone poses a potential information‑leak risk.