The flaw in the Linux kernel’s Bluetooth implementation occurs when an existing extended advertising payload is present and an incoming broadcast announcement is prepended. The kernel does not verify whether the combined size fits in the temporary buffer used to rebuild the advertising data. If it does not, the buffer is overrun, corrupting kernel memory. This corruption can cause a kernel panic or other erratic behavior, effectively rebooting or disabling the affected device. The weakness is consistent with CWE‑131 and CWE‑787.

All Linux kernel releases that include the buggy code are vulnerable. The CPE listing explicitly names kernel version 6.16 (all releases and rc states) and kernel 7.1 rc1 through rc6. Therefore any kernel version prior to the patch in these branches, as well as custom kernel builds derived from them, are affected. Kernel users of newer stable releases that incorporate the commit after the patch are not vulnerable.

The CVSS score of 7.8 classifies the issue as high severity. The EPSS score of less than 1% indicates an extremely low likelihood of exploitation. The vulnerability is not included in CISA’s KEV catalog. Exploitation would require an attacker to transmit an oversized broadcast announcement to the target device, which suggests the likely attack vector involves proximity or direct control of the Bluetooth interface; no remote or network‑based vectors are documented.