In the Linux kernel Bluetooth L2CAP stack, the function l2cap_get_conf_opt() derives the length of an option from an attacker‑controlled field and immediately dereferences the option value before confirming that the requested number of bytes are present in the packet buffer. This results in an out‑of‑bounds read of up to four bytes beyond the end of the buffer. While a post‑hoc check later prevents a data leak in the current control flow, the flaw is a classic validate‑after‑use bug and could expose arbitrary kernel memory if the code is altered or future changes remove the check.

All Linux kernel builds that include the unpatched Bluetooth L2CAP stack are affected. The CVE entry lists Linux as the vendor and does not specify a kernel major or minor version, so any kernel containing the L2CAP module remains potentially vulnerable until the patch is applied.

The vulnerability is triggered by malformed L2CAP packets received over a Bluetooth connection, indicating a remote attack vector. The CVSS score of 7.1 reflects a high severity with potential for information disclosure, while the EPSS score of less than 1 % indicates a very low likelihood of exploitation at present. The issue is not listed in the CISA KEV catalog. However, because the bug reads beyond a buffer boundary, future kernel revisions or changes to the caller paths could enable an attacker to read arbitrary memory, potentially leading to information disclosure.