A stack buffer overflow exists within the Linux kernel Bluetooth HCI sync subsystem in the hci_le_big_create_sync function. The function allocates space for 17 Basic ISolated Service entries but can copy up to 31 entries based on the incoming connection, causing an out-of-bounds write that corrupts kernel stack memory. This attack can be triggered from user space by creating a Bluetooth ISO socket with the maximum BIS count and invoking listen(), which results in a KASAN-detectable stack error. Kernel memory corruption of this type can allow an attacker to execute arbitrary code in kernel mode or destabilize the system, potentially granting local privilege escalation or causing a kernel panic.

Any Linux kernel that includes the Bluetooth HCI sync implementation before the commit that fixed the flex array size is vulnerable. Systems running distribution kernels that incorporate the patch are no longer affected. The vulnerability applies to all kernel versions that contain the vulnerable code path, regardless of specific version numbers as they have not been enumerated in the advisory.

The flaw can be triggered by a local user who can control a Bluetooth ISO socket. Exploit requires setting the BIS count to the maximum value, after which a stack-out-of-bounds write occurs and KASAN flags a fault. The CVSS score is 7.0, the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed wild-world exploit yet. Nevertheless, the potential for local privilege escalation or denial of service warrants immediate patching.