A vulnerable Linux kernel allows a Bluetooth Network Encapsulation Protocol peer to send a truncated BNEP service data unit. The kernel incorrectly assumes that control packet fields are present and dereferences bytes that do not exist, leading to an out‑of‑bounds read. This memory corruption can crash the kernel, and an attacker who can control the payload may be able to manipulate memory further to gain elevated privileges or execute code.

All Linux systems running kernel versions that have not been patched to include the BNEP short‑frame rejection logic. The affected binary is the Linux kernel, specifically the Bluetooth BNEP module; vendor is Linux and product is the Linux kernel. No specific version information is supplied in the advisory, so any kernel prior to at risk.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating that the exploitation probability is not currently high in public data. However, the CVSS score is also absent from the advisory. Based on the description, the likely attack vector is an attacker establishing a Bluetooth connection to the vulnerable host and sending a crafted short frame. Because the flaw occurs in kernel space, successful exploitation can lead to a denial of service or potential privilege escalation. The lack of publicly reported exploits suggests the risk is moderate, but the kernel memory corruption warrants immediate attention.