The Linux kernel’s btintel driver fails to verify the length of the value portion of a Bluetooth TLV when processing a version response. If the value is shorter than required, the driver performs an out‑of‑bounds read via get_unaligned_le16, get_unaligned_le32, or memcpy, exposing kernel memory. This OOB read (CWE‑125) can leak sensitive data and may enable privilege escalation or service disruption.

Any Linux distribution running a kernel with the btintel driver that has not incorporated the patch commit referenced in the provided URLs is potentially vulnerable. The vendor is Linux and the product is the Linux kernel. No explicit kernel version range is given, so any kernel prior to the commit is at risk.

The CVSS score is not supplied, and the EPSS score is unavailable; however, the flaw could be exploited by an attacker who can send crafted Bluetooth responses to the btintel driver. The likely attack vector is local or compromised access to the Bluetooth subsystem that allows malicious TLV payloads. Although the vulnerability is not listed in CISA KEV and no public exploit is known, the risk of leaking kernel memory warrants prompt mitigation.