The Linux kernel’s Bluetooth hci_aml driver reads two length fields from a firmware header and uses them to build pointers before verifying that the entire firmware data is present. If a firmware image is truncated or contains inconsistent length values, the driver may read beyond the allocated firmware buffer while constructing TCI commands. This out‑of‑bounds read can trigger a kernel crash or, depending on the memory region being accessed, could expose privileged kernel data. The core weakness is a lack of bounds checking before use of externally supplied length values.

All Linux kernel releases that include the hci_aml Bluetooth driver and have not applied the recent patch that validates firmware segment lengths are vulnerable. Other Bluetooth drivers and kernel components are not affected by this flaw. No specific version range is provided in the data, so any kernel containing the unpatched hci_aml driver should be considered at risk.

The CVSS score and EPSS are not available, and the vulnerability is not listed in the CISA KEV catalogue, indicating no public exploitation evidence. The likely attack vector requires an attacker to supply a malicious firmware image—through a rogue Bluetooth device or firmware update—to the device. While exploitation is not confirmed, an attacker who can provide such firmware could trigger the out‑of‑bounds read, leading to a denial‑of‑service via kernel crash or potential data leakage if privileged memory is accessed.