The flaw originates when hci_store_wake_reason() is invoked from hci_event_packet() before the event’s payload length is validated. This timing allows a short HCI event frame to reach bacpy() without bounds checking, causing a kernel buffer overflow that can corrupt memory, trigger a kernel panic, or potentially allow execution of arbitrary code.

All Linux kernel builds that contain the legacy Bluetooth HCI event handling code are vulnerable until the commit series that moves wake‑reason storage into validated event handlers is applied. The affected releases are those that do not yet incorporate the changes identified by commits 2b2bf47cd75518c36fa2d41380e4a40641cc89cd and 86c8d07a64d553c41e213b52650020010f9ef23e, so any distribution kernel lacking these patches remains at risk.

The CVSS score of 8.1 denotes high severity, while the EPSS score of < 1 % indicates a low likelihood of exploitation at present and the vulnerability is not listed in CISA KEV. Based on the description, it is inferred that an attacker must inject a crafted HCI event packet via a remote Bluetooth connection to trigger the overflow. If successful, the kernel could crash or be compromised, leading to denial of service or privilege escalation. Although exploitation is currently not widespread, the absence of a bounds check represents a significant risk to kernel integrity.