The flaw lies in the Linux‑kernel Bluetooth stack where the hci_le_create_big_complete_evt routine iterates over an array of BIS handles without checking that the index stays within the declared number of BIS entries. When a controller sends a LE_Create_BIG_Complete event with fewer BIS handles than reported, the code reads beyond the end of the flex array, producing out‑of‑bounds values that are rejected by the connection routine yet leave the connection in a bound state. This triggers an endless loop that keeps the HCI device lock held, causing the kernel to become unresponsive and potentially leading to a system crash or restart. The result is a classic denial‑of‑service that can starve all processes that rely on the Bluetooth stack.

All Linux kernel releases that contain the unpatched hci_le_create_big_complete_evt implementation are affected; no specific version ranges are supplied in the advisory, so the flaw applies to both current and legacy kernels that process LE_Create_BIG_Complete events. The vulnerability is referenced in multiple kernel patch commits linked in the advisory.

No CVSS score is provided and the EPSS metric is unavailable, but the bug can be triggered by a malicious Bluetooth controller that sends a crafted LE_Create_BIG_Complete packet. The attack does not require elevated privileges; it exploits the kernel's handling of a short array and can be delivered over a wireless Bluetooth connection. Because the resulting infinite loop holds a critical lock, the impact is high, yielding a denial of service to the host and all kernel operations. Although the vulnerability is not listed in CISA’s KEV catalog, the moderate complexity of the exploit and the prevalence of Bluetooth interfaces make it potentially widely exploitable.