Within the Linux kernel Bluetooth management stack a flaw in the handling of advertising data can cause the kernel to read past the end of a provided buffer. The function that validates each TLV element accesses a length byte before confirming that the element’s type byte lies within bounds, allowing a crafted packet to overflow the bounds check and trigger a read out of bounds. The memory sanitizer shows the bug as a "vmalloc‑out‑of‑bounds" read, indicating that the kernel is likely to crash or behave unpredictably when an attacker sends a malformed MGMT_OP_ADD_ADVERTISING request. The immediate consequence is a kernel panic and loss of service for the affected node, and repeated exploitation could allow denial of service to be sustained.

All Linux distributions that ship a kernel prior to the patch that contains this fix are affected, regardless of the distribution. The vulnerability applies to the generic Linux kernel image as listed by the CNA and does not reference a narrower version range. Adversaries can trigger the flaw via a Bluetooth MGMT interface; the device must have the Bluetooth stack enabled for mgmt commands.

The CVSS score is not provided, but the exploit would be local to the Bluetooth interface and would require network proximity or a compromised local Bluetooth client. The EPSS is marked as not available, and the vulnerability is not listed in CISA’s KEV catalog. The primary risk is a local denial of service that can be triggered by sending a specially crafted advertising request. The attacker must be able to initiate a Bluetooth MGMT request to the target device. Without that, the flaw cannot be exercised. The vulnerability is mitigated by applying the kernel patch that moves the length check before the type-octet inspection, which restores proper bounds verification.