In the Linux kernel Bluetooth management layer, the mesh_send() routine verifies only the overall command length but does not confirm that the advertised data length field matches the size of the payload array. This oversight (CWE‑130) allows a crafted, truncated command to bypass existing checks and cause the asynchronous mesh send path to read past the end of the queued buffer, creating a memory corruption condition that can be abused to execute arbitrary code with kernel privileges.

All Linux kernel variants that incorporate the Bluetooth MGMT interface are potentially impacted. No precise version range is given, so any kernel that contains the unpatched Bluetooth code and processes mesh send commands may be vulnerable.

The CVSS score of 5.5 indicates a medium severity, the EPSS score of < 1% indicates a very low exploitation probability, and it is not listed in the CISA KEV catalog. Based on the description, the attack vector is most likely remote via a Bluetooth connection, though the required preconditions are not fully detailed. Successful exploitation would trigger a memory corruption in the kernel through the mesh send path, potentially leading to privilege escalation to kernel level if an attacker can control the result of the asynchronous operation.