The flaw lies in how the Bluetooth eir_get_service_data routine processes advertising data: it incorrectly advances the pointer and length counters for fields that do not match the expected UUID, causing the routine to read beyond the bounds of the advertising buffer. A remote attacker can craft a Bluetooth advertisement packet that contains mismatched Service Data fields, which triggers the out‑of‑bounds read. The kernel then copies memory from a location beyond the advertised buffer into a structure that is subsequently exposed to user space via the getsockopt(BT_ISO_BASE) interface. This results in a CWE‑125 out‑of‑bounds read that can leak kernel memory contents to an unprivileged user, compromising confidentiality.

All Linux kernel builds that include the Bluetooth eir interface are affected, especially those accessing the le_per_adv_data[] field as described. The fix has been applied to the current kernel source mentioned in the advisory, but any kernel prior to that revision remains vulnerable. The vendor list indicates Linux, and the affected product is the Linux kernel as a whole.

The assigned CVSS score of 6.8 places this vulnerability in the medium severity range. The EPSS score of 0.00168 indicates a very low but non‑zero likelihood of exploitation, and it is not listed in the CISA KEV catalog. The attack vector is remote via Bluetooth: an adversary with a Bluetooth transmitter can send the crafted packet to the host without requiring local privileges or user interaction. Because the flaw only leads to information disclosure and does not provide privilege escalation or denial of service, the overall exploitation likelihood is moderate but non‑negligible for environments where rogue Bluetooth devices are a concern.