The vulnerability allows a Bluetooth controller to request firmware data from a Linux kernel driver. In the v3 firmware download path, the driver only checks the lower bound of the requested offset but does not ensure that the offset plus length remains within the firmware image. A malicious controller can therefore cause the driver to read memory beyond the end of the firmware image and transmit that data back over UART. The exploit can disclose arbitrary kernel memory contents, potentially revealing sensitive information such as cryptographic keys or user data, which may be leveraged for further attacks. This flaw is a classic out‑of‑bounds read and can lead to information exposure.

All Linux kernel implementations that include the btnxpuart Bluetooth driver without the recent patch are affected. The specific kernel versions are not listed, but the fix is present in the mainline kernel as referenced by the provided commit URLs.

The CVSS score of 5.5 indicates a moderate severity for this vulnerability. The EPSS score is less than 1%, indicating a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attack requires a controller that can issue v3 firmware download requests, which is typically a legitimate Bluetooth device. Once the offset or length exceeds bounds, the driver will read beyond the firmware buffer and return that data to the controller. The attacker can then retrieve arbitrary kernel memory via the UART interface. While the overall risk is moderate due to the low exploitation probability and the need for specialized interaction, the information disclosure could still be impactful for privileged exploits.