Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend vulnerability in the Linux kernel allows for a buffer overrun during the rebuilding of advertising data. When a host holds an extended advertising payload and receives a broadcast announcement, the kernel prepends the service data without confirming the combined size fits in the temporary buffer. This can corrupt memory and potentially trigger a kernel panic, resulting in denial of service. The fix rejects the oversized request before copying and logs the failure, preserving existing advertising data.

The affected code resides in the core Linux kernel Bluetooth stack. The CPE string provided is generic for all Linux kernels, and no specific version range is in the advisory. Therefore, any Linux kernel firmware that has not yet incorporated the patch is potentially vulnerable. Distribution‑specific build customizations that include the kernel code could also be affected.

The CVSS score is not supplied in the advisory, and the EPSS score is unavailable. Consequently, no quantifiable exploitation probability can be stated. The vulnerability is not listed in the CISA KEV catalog. To trigger the flaw, an attacker would need to transmit an oversized broadcast announcement to the device, which generally requires physical proximity or a compromised Bluetooth interface. Given the lack of evidence of active exploitation, the risk remains moderate for systems that rely on Bluetooth advertising, while it is lower for devices that do not use advertising or have Bluetooth disabled.