The flaw is in the Bluetooth qca driver’s TLV parser. A signed firmware length value is converted to an unsigned size_t when checking the loop bound; if the length is less than 12, the subtraction wraps to a very large unsigned value and the loop reads past the end of the allocated firmware buffer. The out‑of‑bounds read can later be followed by writes that disturb kernel memory. An attack that supplies a firmware image with a small length can thus corrupt, crash the kernel or potentially allow execution of code in kernel mode. The weakness is a classic buffer mis‑calculation (CWE-125).

All Linux kernel releases that include the qca Bluetooth driver before the committed patch are affected. Devices such as routers, embedded boards, laptops or any hosts that load qca firmware during Bluetooth initialization are at risk. The corrective commit has merged into recent stable kernel branches and is available through the official kernel source or downstream distributions.

The flaw is triggered when the qca driver parses a firmware TLV. If a firmware image supplies a signed length less than 12, the loop bound underflows, leading to an out‑of‑bounds read that can corrupt kernel memory during parsing. The CVSS score of 7.0 indicates a high impact. The EPSS score of < 1% suggests an extremely low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The data does not indicate any publicly documented exploitation technique; the attack would require influencing the firmware that is loaded during Bluetooth initialization.