In Linux kernel Bluetooth code, the handler for the LE Set CIG Parameters response trusts the num_handles field without validating that the accompanying handle array fully exists in the received packet. If a controller returns a truncated response, the code reads beyond the supplied socket buffer, which can trigger a buffer overread. This uncontrolled read can lead to kernel crashes or leakage of kernel memory contents, effectively providing a denial‑of‑service mechanism for a malicious Bluetooth controller.

This flaw exists in the Linux kernel Bluetooth subsystem; any kernel version that contains the vulnerable hci_event handling code is impacted. No specific kernel version range is listed, so all kernels not yet patched must be considered at risk.

The EPSS score is unavailable and the vulnerability is not listed in the KEV catalog, yet the potential for a kernel crash or information leak remains serious. Attack execution requires a malicious or compromised Bluetooth controller that can send a malformed LE Set CIG Parameters response, which is feasible with a nearby device or an untrusted controller.