A flaw in the Linux kernel BT HCI stack’s codec capability parsing allows a malformed controller response to bypass length validation. The kernel copies payload bytes beyond the advertised length, corrupting memory. This bug can lead to crashes or facilitate privilege escalation when an attacker can send crafted responses. The weakness stems from inadequate bounds checking (buffer overflow).

The issue exists in all Linux kernel releases that contain the Bluetooth HCI code prior to the fix that added full element size validation. Consequently, most current distributions running unpatched kernels are affected. The reference commits show the code was corrected in a later kernel update; administrators should confirm which kernel versions include the patch.

The EPSS score of < 1% indicates a very low yet non‑zero probability of exploitation, while the CVSS score of 8.8 highlights a high severity due to potential memory corruption. The vulnerability is not listed in CISA KEV, implying no known widespread exploitation. The likely attack vector is local, requiring proximity to the target device or control over a nearby or compromised wireless adapter.