The vulnerability resides in the Bluetooth subsystem of the Linux kernel where the read parsers for supported codecs do not validate the size of the vendor codec array after consuming the variable-length standard codec data. When a controller replies that ends immediately after the standard array, the code calculates the vendor codec count from data that lies outside the provided packet, resulting in out-of-bounds memory access. This flaw can corrupt kernel memory, potentially causing a crash, denial of service, or in extreme cases, arbitrary code execution if an attacker can control the memory layout.

All organisms shipping the Linux kernel before the removal of the bug are affected. The flaw is present in every kernel release that contained the unvalidated hci_codec logic, regardless of distribution. End users who run a Linux kernel on any hardware with Bluetooth support are at risk until the kernel is updated to a patched version.

The attack vector is remote and relies on a crafted Bluetooth packet sent by a malicious controller. An attacker would need to send a specially crafted controller reply that tricks the Linux kernel into reading beyond the supplied data, which can cause a memory corruption that may lead to a crash and possible remote code execution. The CVSS score of 7.0 indicates high severity. The EPSS score is less than 1% and the vulnerability is not listed in CISA KEV, so the likelihood of exploitation is uncertain; nevertheless, because the flaw allows untrusted data to influence kernel memory, it should be treated as high-risk.