A defect in the btintel driver causes the diagnostics handler to read the first byte of a TLV value without verifying that the payload is large enough. This out‑of‑bounds read can leak kernel data and may crash the process handling the frame, potentially leading to a denial‑of‑service. The weakness stems from insufficient input validation when parsing Bluetooth diagnostic frames.

The vulnerability exists in the Linux kernel’s btintel module. Affected releases are all kernel versions that contain the unpatched implementation. No specific minor or patch releases are listed in the CVE data, so any kernel installing that code path without the patch is at risk.

The CVSS score is 5.5, and the EPSS score is <1%, indicating a moderate severity and a low probability of exploitation. Because the flaw is in kernel space, a local attacker who can influence the Bluetooth stack may trigger it, or an attacker could force the kernel to read from an attacker‑controlled buffer to expose sensitive memory. The lack of an official KEV listing suggests that active exploitation is not widespread at this time, but the kernel context and lack of input validation give this vulnerability a moderate to high likelihood of serious impact if exploited.