The vulnerability resides in the Linux kernel's Bluetooth HCI socket implementation, where the security filter intended to restrict command usage incorrectly masks a 10‑bit OCF value with 127. This flaw allows an unprivileged socket to submit a reserved OCF that aliases an allowlisted command modulo 128, thereby bypassing the intended command authorization controls and potentially enabling unauthorized command execution within the host.

All Linux kernel implementations that have not yet incorporated the commit correcting the OCF masking logic are affected. The flaw exists in the core Bluetooth stack of every distribution shipping an unpatched kernel, with no vendor or product outside the kernel itself mentioned.

The CVSS score is 4.4, and the EPSS score is less than 1%. While the vulnerability may not currently be widely exploited (not listed in KEV and low EPSS probability), it still provides a local privilege escalation path for any user or process that can open the Bluetooth HCI socket. An attacker would need local access to craft a special OCF value; if successful, the aliasing allows execution of an allowlisted command that was intended to be restricted.