The Linux kernel’s btintel Bluetooth driver interprets the firmware ID field of a TLV as a NUL‑terminated string, even though the TLV length is the sole boundary. When the payload does not contain a NUL byte, the snprintf call used to copy the ID can read beyond the advertised length, exposing data that resides next to the firmware ID in kernel memory. This out‑of‑bounds read can leak confidential information but does not directly enable code execution or denial of service.

Systems that ship a Linux kernel containing the btintel driver are affected. The advisory does not list specific kernel release numbers, so any kernel version that includes this driver prior to the fix is at risk. The issue is confined to kernel‑space driver code, not user‑space applications.

The CVSS score of 5.5 and an EPSS score of < 1% suggest a moderate risk, and the vulnerability is not tracked in the CISA KEV catalog. It is inferred from the description that an attacker can trigger the buffer overread by sending a crafted firmware request from an external Bluetooth device, meaning the attack vector is an unauthenticated Bluetooth interface. No publicly available exploit is known, but an attacker who can communicate with the device’s Bluetooth stack can potentially force the driver to read beyond the TLV boundary and obtain sensitive data stored adjacent to the firmware ID.