A Bluetooth device driver in the Linux kernel performs an out‑of‑bounds read when processing a firmware revision string. The routine treats the device response as a NUL‑terminated string without verifying the length, causing the kernel to read past the reply and expose adjacent slab memory in the system log and the firmware‑info debugfs file. An attacker with the ability to control a Bluetooth device could use this flaw to leak kernel memory contents, resulting in a confidentiality compromise. The flaw does not allow arbitrary code execution or denial of service, but it does provide a vector for local or device‑controlled memory disclosure.

The vulnerability resides in the generic Linux kernel (any distribution) and affects any module implementing the bpa10x Bluetooth driver prior to the commit that bounds the string output. All kernel builds before the patch that adds a bounded "%.*s" format specifier are potentially impacted.

The CVSS score of 5.5 indicates a medium severity, while the EPSS score of <1% suggests a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a Bluetooth device that can communicate with the kernel and send a malformed reply; the attacker would need access to the device or to compromise the Bluetooth stack. While the risk of widespread exploitation appears low, the exposure of kernel data in system logs elevates the privacy impact for systems where logging or debugfs output is accessible.