The vulnerability lies in the Linux kernel’s Bluetooth L2CAP layer, where the code fails to validate the length of incoming frames before accessing the control field and optional Frame Check Sequence. This omission allows a short frame to trigger an out‑of‑bounds read, potentially exposing kernel memory contents or enabling further exploitation. At its core, the weakness is a classic out‑of‑bounds memory read."

Linux kernel deployments that include the Bluetooth L2CAP driver are affected. The vulnerability does not specify version constraints, so it is prudent to assume that all kernel branches containing the unpatched code are vulnerable until verified otherwise."

The flaw permits a crafted Bluetooth packet to cause the kernel to read past the end of the skb buffer, which could lead to information disclosure or a denial of service. While there is no publicly available exploitation kit, a remote attacker with Bluetooth communication privileges can send the malformed packet, making the attack vector likely remote and local to the host’s Bluetooth stack. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting that it may not yet be widely exploited but remains a legitimate risk.