The vulnerability resides in the Linux Bluetooth USB driver (btusb) when it processes vendor events from Realtek adapters. The btusb_recv_event_realtek function reads the event code at data[0] and the vendor‑specific subevent code at data[2] prior to determining whether the event should be treated as a coredump. Because the implementation assumes that the packet contains a third byte, an event packet that is shorter than expected can cause the function to read beyond the packet boundary. This out‑of‑bounds read may lead the driver to mistakenly classify a short, normal event as a fatal coredump, which can trigger a kernel crash and deny service to the affected host.

Affected systems include any Linux kernel that has not yet integrated the validation patch for btusb vendor event length. The flaw impacts the btusb driver and applies to Realtek USB Bluetooth adapters that send vendor‑specific event packets. Distributions that ship unpatched kernels with active Bluetooth support—and particularly those that allow Realtek adapters to be connected—are vulnerable regardless of the system architecture.

The CVSS score is 6.5, the EPSS score is < 1%, and it is not listed in the CISA KEV catalog, indicating no known widespread exploitation. Based on the description, it is inferred that an attacker would need to transmit a crafted Bluetooth vendor event packet to a Realtek USB adapter, which could be achieved from a nearby malicious device or through a compromised local adapter. Because the exploit requires direct interaction with the Bluetooth interface and no public proof of concept is available, the overall risk may be considered moderate, but the potential impact of a kernel crash remains high.