The driver for the virtio Bluetooth backend fails to validate the length of incoming packets before passing them to the core HCI handling routine. The missing check allows an attacker to send a packet that contains only the type byte and no header data. When the kernel interprets this data, it may read uninitialized bytes from the buffer, resulting in an out‑of‑bounds read and potential kernel log flooding. The flaw does not directly provide code execution, but it can lead to denial of service or inadvertent disclosure of kernel memory contents.

Affected systems are Linux kernels that load the virtio_bt module to support Bluetooth over a VirtIO backend. All kernel versions released before the patch that introduced length validation are vulnerable; specific release numbers are not listed in the advisory. Users employing virtualized environments with Bluetooth passthrough via VirtIO should review whether the driver is present.

No CVSS score or EPSS metric is available for this vulnerability, and it is not listed in CISA’s KEV catalog. The attack likely requires control of the VirtIO backend or the ability to inject crafted packets into the Bluetooth device queue. If such an interface can be reached by an attacker—such as a guest VM or an untrusted host device—the opportunity exists to trigger the out‑of‑bounds read by transmitting an undersized packet. Because the kernel logs the error via a ratelimited mechanism, repeated exploitation could still degrade system availability through excessive logging or subtle memory corruption.