This vulnerability arises within the Linux kernel Bluetooth stack, specifically the hci_ll module's firmware download routine. When a firmware fetch succeeds but the firmware payload is empty or invalid, the routine exits without releasing the firmware resource, creating a memory/resource leak. This weakness (CWE‑772) can cause gradual exhaustion of kernel memory, potentially leading to system instability or a denial‑of‑service condition.

The flaw affects any Linux kernel that implements the hci_ll component of the Bluetooth subsystem. All distributions that ship the stock kernel without the reported fix are potentially vulnerable. No specific kernel release series or versions are listed in the advisory, so any kernel lacking the recent patch qualifies.

The CVSS score of 5.5 and the EPSS score of <1% indicate a moderate risk of exploitation. The flaw is not included in the CISA KEV catalog. An attacker would need to trigger the firmware load path with an invalid firmware blob. Inferred from the EPSS score, the overall likelihood of exploitation appears low. The primary impact is denial‑of‑service through resource exhaustion; the risk depends on an adversary’s ability to invoke the firmware loading routine on the vulnerable host.