The vulnerability exists in the Linux kernel Bluetooth L2CAP stack. Connectionless frames carry a two‑byte Protocol Service Multiplexer (PSM) value at the start of the payload, but the l2cap_recv_frame() function reads that PSM unconditionally after only validating the outer L2CAP length. If a packet has a payload shorter than two bytes, the parser reads beyond the advertised packet bounds, pulling data from the skb tailroom. This out‑of‑bounds read (CWE‑125) can expose arbitrary kernel memory contents or cause a kernel panic, leading to a denial of service.

All Linux kernels that include the vulnerable code path are affected; the flaw resides in the core Bluetooth implementation and applies to any distribution or configuration that has not upgraded past the commit shown in the provided git patches.

A malicious actor can deliver a crafted Bluetooth frame to trigger the flaw. Based on the description, it is inferred that the attack can occur over the air without privileged access. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Although no exploit is currently reported, the straightforward nature of the out‑of‑bounds read makes exploitation likely for an attacker who can send malformed frames.