The vulnerability lies in the Linux kernel’s Bluetooth L2CAP layer, where the code fails to validate the length of incoming frames before accessing the control field and optional Frame Check Sequence. This omission allows a short frame to trigger an out‑of‑bounds read, potentially exposing kernel memory contents or enabling further exploitation. At its core, the weakness is a classic out‑of‑bounds memory read.

Linux kernel deployments that include the Bluetooth L2CAP driver are affected. The vulnerability does not specify version constraints, so it is prudent to assume that all kernel branches containing the unpatched code are vulnerable until verified otherwise.

Based on the description, it is inferred that the attack vector is through a crafted Bluetooth packet. The flaw permits a crafted Bluetooth packet to cause the kernel to read past the end of the skb buffer, which could lead to information disclosure or a denial of service. While there is no publicly available exploitation kit, a remote attacker with Bluetooth communication can send the malformed packet, making the attack vector likely remote and local to the host’s Bluetooth stack. The CVSS score of 6.5 indicates medium severity, and the EPSS score is less than 1%, suggesting the likelihood of exploitation is low. The vulnerability is not listed in the CISA KEV catalog, indicating it has not yet been widely exploited but remains a legitimate risk.