The Linux kernel Bluetooth Intel driver interprets the firmware ID in a TLV as a NUL-terminated string even though no NUL terminator is required. If the TLV payload does not contain a NUL byte, the snprintf call used to copy the ID can read past the advertised TLV length and leak data from kernel memory. An attacker who can send a crafted Bluetooth firmware request could trigger this out‑of‑bounds read, potentially accessing confidential data stored adjacent to the firmware ID string. The flaw does not directly allow code execution but it can enable sensitive information disclosure and may crash the driver during normal operation.

Vulnerable systems are Linux distributions that ship the Linux kernel with the btintel Bluetooth Intel driver. No specific kernel release numbers are provided in the public advisory, so any kernel version containing this driver prior to the fix is at risk. The issue is specific to the driver code handling the firmware response, not to user space applications.

The CVE does not list a CVSS score or EPSS, and it is not in the CISA KEV catalog, indicating that the overall risk has been assessed as moderate at this moment. However, the vulnerability is exploitable from an external Bluetooth device, meaning that any client device that can communicate with the kernel’s Bluetooth stack can trigger the read. No public exploit has been reported, so the likelihood of successful exploitation in the wild may be low, but the potential impact of information leakage warrants attention. The threat is most effective against devices that expose Bluetooth services and are reachable by attackers.