The Linux kernel Bluetooth stack contains an out‑of‑bounds read in the hci_le_create_big_complete_evt handler. It iterates over an array of BIS handles without ensuring the index does not exceed the reported number of bis_handle entries. When a controller sends a LE_Create_BIG_Complete event with fewer BIS handles than reported, or with num_bis set to zero, the function reads beyond the valid array into adjacent heap memory. These out‑of‑bounds values are rejected by the connection routine, but the associated connection remains in a bound state. An infinite loop then occurs while a critical HCI device lock is held, making the kernel unresponsive while Bluetooth functions are active.

All Linux kernel builds that include the pre‑patch hci_le_create_big_complete_evt routine are vulnerable. No specific version range is listed in the advisory, so the flaw applies from the earliest kernel release that processes LE_Create_BIG_Complete events up to the latest unpatched kernel. The patch is referenced by commit 22559ad… in the kernel source history.

Based on the description, it is inferred that the likely attack vector is a malicious LE_Create_BIG_Complete packet transmitted over a Bluetooth link. The CVSS score is 8.1, indicating high severity, and the EPSS score is less than 1%, implying a low current exploitation probability. An attacker only needs to transmit that packet; no elevated privileges are required. The vulnerability is not listed in CISA’s KEV catalog.