In the Linux kernel’s Bluetooth subsystem, the hci_sock module processes incoming event packets without verifying that the packet data buffer contains any bytes before reading the event code. When an opcode filter is active, the code also reads command opcodes at offsets 3 or 4 without confirming that a Command Complete or Command Status event is sufficiently long. If a malformed event is supplied by a Bluetooth controller or a virtual device, the kernel performs an out‑of‑bounds read, potentially leaking kernel memory and sensitive information. The issue was resolved by adding checks that reject packets too short for the fields being inspected, ensuring only valid data is processed.

All Linux kernel builds that include the default hci_sock Bluetooth driver are impacted, including all mainstream distributions that ship the bundled kernel source prior to the fix. Because no explicit version range is provided, any kernel that implements the old logic and has not been patched is potentially vulnerable. This applies to systems that communicate with external Bluetooth controllers or virtual devices using the standard HCI socket interface.

The CVSS score for this vulnerability is 5.5, indicating a medium severity. EPSS indicates an exploitation probability of less than 1%, and the vulnerability is not listed in the CISA KEV catalog. The flaw permits an out-of-bounds read through malformed Bluetooth HCI event packets; if an attacker can send crafted data to the kernel’s hci_sock subsystem, they may read sensitive kernel memory. Although the exploit requires the ability to generate or spoof Bluetooth events, such packets can be created by rogue Bluetooth controllers or virtual devices connected to the target system, allowing information disclosure or further privilege escalation.