A Linux kernel bug allows the Bluetooth management interface to accept a command length field that exceeds the 8‑bit header’s maximum of 255. Because the kernel does not enforce an upper bound, a 256‑byte command is treated as having a zero‑length payload while all 256 bytes are still transmitted. This mismatch causes the controller to misinterpret subsequent bytes, potentially leading to kernel memory corruption and arbitrary code execution if an attacker can craft such packets.

The flaw exists in all Linux kernel releases that include the Bluetooth MGMT stack before the patch added proper validation. Any system running a kernel that has not been updated to the version containing commit 03f1700b9b4d, or earlier, is susceptible. The affected component is the kernel’s Bluetooth management subsystem, which can be triggered by a Bluetooth controller speaking the HCI_CMD_SYNC interface.

The vulnerability does not have an EPSS score and is not currently listed in the CISA KEV catalog, but its potential to corrupt kernel memory grants attackers high severity. Exploitation would rely on an attacker being able to send crafted HCI packets via an active Bluetooth connection, which may be achieved locally or remotely wherever the Bluetooth stack is reachable. The lack of an upper bound means the attack surface is broad, and failure to detect the malformed command could allow privilege escalation to root or other elevated levels. Until a patched kernel is in place, the risk remains significant for any host with a Bluetooth interface enabled.