This flaw occurs when the btmtk USB Bluetooth driver casts the data from a received WMT event into specific structs without verifying that the packet contains enough bytes. The missing check allows an attacker to trigger out‑of‑bounds reads from the packet tailroom, which can expose the contents of kernel memory and potentially crash the system. The vulnerability is therefore a classic out‑of‑bounds read that can lead to information disclosure or a denial‑of‑service if an attacker can deliver a specially constructed, undersized firmware response.

The affected product is the Linux kernel, specifically the btmtk driver that handles Bluetooth USB devices. No specific kernel version numbers are listed in the CVE, but the vulnerability was fixed in the commit referenced in the advisory. All Linux systems that load the btmtk USB Bluetooth module and receive WMT event responses are potentially impacted.

The CVSS score is not listed, so we cannot quantify the severity from the data, but an out‑of‑bounds read in the kernel is a high‑severity flaw. EPSS is not available, and the vulnerability is not in the CISA KEV catalog. The likely attack vector is local or via compromised USB/Bluetooth firmware that can send a crafted, short WMT event. An attacker with physical access to a Linux system or control over a Bluetooth USB device could exploit this to read memory or crash the kernel.