btmtksdio.c and btmtkuart.c cast a received WMT event straight to a specific struct without verifying the buffer length, allowing the driver to read past the end of the packet. This out‑of‑bounds read can trigger a kernel panic or other denial‑of‑service behavior. The patch validates the base header and the FUNC_CTRL case to prevent this. Based on the description, it is inferred that only events originating from a remote Bluetooth device can trigger this flaw, because the event arrives through the Bluetooth stack.

The vulnerability affects the Linux kernel Bluetooth subsystem modules btmtksdio and btmtkuart that power MediaTek wireless chipsets, including the MT7920, MT7921, MT7922, and MT7925. All Linux kernel versions that include these modules prior to the patch are potentially vulnerable.

The EPSS score is <1%, indicating a very low probability of exploitation. The vulnerability is not catalogued in CISA KEV. Based on the description, it is inferred that an attacker would need the ability to send a malicious WMT event over an active Bluetooth connection, a likely remote attack vector. The flaw causes a silent out‑of‑bounds read that can crash the kernel, classifying it as a high‑severity denial‑of‑service behavior, but the odds of exploitation remain low given the current evidence. The CVSS score of 5.5 indicates a medium severity assessment.