In the Linux kernel’s btintel driver, the length of the value portion of a Bluetooth TLV is not verified when processing a version response. If the value is shorter than required, the driver performs an out‑of‑bounds read via get_unaligned_le16, get_unaligned_le32, or memcpy, exposing kernel memory. This CWE‑125 flaw could leak sensitive data.

Any Linux distribution running a kernel with the btintel driver that has not incorporated the patch commit referenced in the provided URLs is potentially vulnerable. The vendor is Linux and the product is the Linux kernel. No explicit kernel version range is given, so any kernel prior to the commit is at risk.

The CVSS score of 5.5 and an EPSS score of < 1% indicate moderate severity and low exploitation likelihood. The flaw can be leveraged by an attacker who has the ability to send crafted Bluetooth responses to the btintel driver, potentially causing an out‑of‑bounds read through get_unaligned_le16, get_unaligned_le32, or memcpy. While the vulnerability is not listed in the CISA KEV catalog and no public exploits are known, the potential leakage of kernel memory remains a concern, especially in environments with exposed Bluetooth interfaces.