The Linux kernel Bluetooth stack contains a flaw in the L2CAP signaling packet parser. When a BR/EDR peer sends a fixed‑channel packet that exceeds the allowed signaling MTU (typically 48 bytes) but falls within the channel MTU, the kernel accepts the packet and dispatches every command inside without checking the size. An attacker can pack many L2CAP_ECHO_REQ commands into a single 681‑byte packet. For each command the kernel then generates an L2CAP_ECHO_RSP frame. In a real‑world test the victim transmitted 168 response frames over roughly 220 ms, illustrating a forced high‑rate transmission that can exhaust local radio resources or saturate the device’s traffic handling.

The weakness affects the generic Linux kernel, specifically the Bluetooth L2CAP implementation located in net/bluetooth/l2cap_core.c. No particular kernel version is listed in the advisory, but all kernels containing the unpatched code are vulnerable. The vulnerability resides in the lower‑level Bluetooth stack and can be triggered by any device that communicates over Bluetooth BR/EDR with the affected host.

The flaw is exploitable by any Bluetooth BR/EDR device within radio range of the target before pairing is established. Because the attack only requires sending a single oversized signaling packet, the adjacency requirement is the main limitation. No public exploits have been reported and the vulnerability is not listed in the CISA KEV catalog, but the lack of an immediate fix in the kernel code and the deterministic resource consumption make the risk moderate to high for deployments that keep Bluetooth enabled. The EPSS score is unavailable, so the actual probability of exploitation cannot be quantified, but the potential impact is a denial of service that forces the device to transmit many frames.