Technical impact
This flaw occurs when the btmtk USB Bluetooth driver casts the data from a received WMT event into specific structs without verifying that the packet contains enough bytes. The missing check allows an attacker to trigger out‑of‑bounds reads from the packet tailroom, which can expose the contents of kernel memory and potentially crash the system. The vulnerability is therefore a classic out‑of‑bounds read that can lead to information disclosure or a denial‑of‑service if an attacker can deliver a specially constructed, undersized firmware response.
Affected Systems
The affected product is the Linux kernel, specifically the btmtk driver that handles Bluetooth USB devices. Kernel versions 7.1 RC1 and 7.1 RC2 are explicitly identified as affected by the CPE data. Linux systems running these releases that load the btmtk USB Bluetooth module and receive WMT event responses are potentially impacted.
Risk and Exploitability
The CVSS score is 7.1 and the EPSS score is < 1%, indicating a high‑severity flaw with a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local or via a compromised USB/Bluetooth firmware that can send a crafted, short WMT event. An attacker with physical access to a Linux system or control over a Bluetooth USB device could exploit this to read memory or crash the kernel.
Ubuntu USN