The Linux kernel’s Bluetooth L2CAP stack contains a validate‑after‑use flaw where the function l2cap_get_conf_opt() derives the length of an option from an attacker‑controlled field and immediately dereferences the option value before confirming that the packet buffer contains that many bytes. This results in an out‑of‑bounds read of up to four bytes past the buffer’s end. While a post‑hoc check later prevents a data leak in the current control flow, the bug remains a classic buffer read vulnerability (CWE‑125, CWE‑476, CWE‑805) that could expose arbitrary kernel memory if the code is altered or future changes remove the check.

The flaw affects all Linux kernel builds that include the L2CAP module. The CPE list points to Linux kernel 7.2 release candidates (rc1, rc2) and to Linux kernels in general; therefore any kernel containing the unpatched Bluetooth L2CAP stack remains potentially vulnerable until the patch is applied.

Based on the description, it is inferred that the flaw can be triggered by malformed L2CAP packets received over a Bluetooth connection, making it a remote vulnerability. The CVSS score of 7.1 indicates high severity with potential for information disclosure, while an EPSS score of less than 1 % reflects a currently low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, but because it reads beyond a buffer boundary, future kernel revisions or modifications that remove the post‑hoc check could enable an attacker to read arbitrary memory, raising the impact even further.