The vulnerability resides in the Linux kernel's Bluetooth HCI socket implementation, where the security filter intended to restrict command usage incorrectly masks a 10‑bit OCF value with 127. This flaw allows an unprivileged socket to submit a reserved OCF that aliases an allowlisted command modulo 128, thereby bypassing the intended command authorization controls and potentially enabling unauthorized command execution within the host.

All Linux kernel implementations that have not yet incorporated the commit correcting the OCF masking logic are affected. The flaw exists in the core Bluetooth stack of every distribution shipping an unpatched kernel, with no vendor or product outside the kernel itself mentioned.

The CVSS score is not provided and no EPSS data is available, so the exact severity cannot be quantified. The flaw offers a local privilege escalation path for any user or process that can open the Bluetooth HCI socket. Based on the description, this is most easily exploited by an attacker with local access to the socket, as the exploit requires crafting a special OCF value. The absence of a KEV listing and a lack of EPSS data mean that active exploitation is currently unknown, but local attackers could leverage the aliasing behavior to gain elevated privileges.