The vulnerability lies in the virtio_bt driver, where the length of data reported by a virtqueue backend is used directly to expand a socket buffer without sufficient validation. An attacker could craft a backend response with a length exceeding the 1000‑byte buffer actually allocated for the packet, leading the kernel to write uninitialized memory into the heap. If the length reported is zero, the driver still reads a packet type byte from uninitialized data, potentially exposing sensitive kernel information or contributing to a crash. Mutating kernel memory or leaking data are the primary consequences, which could enable privilege elevation or stability degradation.

All Linux kernel variants that include the virtio_bt Bluetooth driver, without specific version restrictions indicated. The issue impacts the Bluetooth subsystem of virtualized environments where the virtio_bt backend is enabled.

The CVSS score is not supplied, but the nature of an unchecked buffer length gives this flaw a high severity. Exploitability requires control over or interaction with the virtqueue backend; it is therefore considered a local or device‑authenticated attack. No EPSS data is available, and the flaw is not listed in CISA’s KEV catalog. The practical attack vector likely involves a compromised or malicious Bluetooth backend or a bug in virtual device firmware. Because the flaw writes to the kernel heap, successful exploitation could lead to a kernel panic or arbitrary code execution at the system level.