The Linux kernel Bluetooth management code does not validate the enc_size field of a Long Term Key (LTK) when loading key data. The value is stored and later used to size a fixed‑size stack buffer for LE LTK replies. If an attacker supplies an enc_size larger than the 16‑byte buffer, the kernel later copies the payload into that oversized buffer, causing a stack overflow that can lead to arbitrary code execution with kernel privileges. This is a classic stack‑based buffer overflow that trusts user input without bounds checking.

All Linux kernel installations are vulnerable until the patch that validates the LTK enc_size is applied. The vulnerability is reported for the generic Linux kernel (Linux:Linux) with no specific kernel release identified, so any current kernel should be treated as potentially vulnerable.

The CVSS score is 7.8, indicating high severity. The EPSS score of less than 1% shows a very low but nonzero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a Bluetooth-enabled device that can send a crafted LTK record; an attacker can trigger the overflow over an active Bluetooth connection and gain kernel privileges.