The kernel Bluetooth L2CAP implementation fails to validate the length of an incoming protocol data unit before reading the service data unit length. The routine l2cap_ecred_data_rcv() extracts a 16‑bit length field from the packet buffer without confirming that the buffer contains at least two bytes, which can cause an out‑of‑bounds read of kernel memory. This defect could leak sensitive kernel data to an attacker or trigger an exception that may lead to a crash. The weakness is a buffer over‑read (CWE‑1284) and a memory access error.

Any Linux system whose kernel builds include the Bluetooth L2CAP stack is potentially affected. The patch has been merged into the main Linux kernel tree, but specific affected kernel releases are not listed in the advisory.

The advisory lists a CVSS score of 5.5 and an EPSS score of less than 1%, indicating a medium severity but a very low probability of exploitation at the time of this analysis. The flaw allows only a memory read; exploitation could result in information disclosure or a denial‑of‑service via a kernel crash. The likely attack vector is through a Bluetooth connection that can supply crafted L2CAP frames, and no local privileges are required. The vulnerability is not listed in the CISA KEV catalog, but the presence of a medium CVSS score and the absence of a known exploit do not diminish the need for timely patching.