In the Linux kernel’s Bluetooth subsystem, the hci_sock module processes incoming event packets without verifying that the packet data buffer contains any bytes before reading the event code. When an opcode filter is active, the code also reads command opcodes at offsets 3 or 4 without confirming that a Command Complete or Command Status event is sufficiently long. If a malformed event is supplied by a Bluetooth controller or a virtual device, the kernel performs an out‑of‑bounds read, potentially leaking kernel memory and sensitive information. The issue was resolved by adding checks that reject packets too short for the fields being inspected, ensuring only valid data is processed.

All Linux kernel builds that include the default hci_sock Bluetooth driver are impacted, including all mainstream distributions that ship the bundled kernel source prior to the fix. Because no explicit version range is provided, any kernel that implements the old logic and has not been patched is potentially vulnerable. This applies to systems that communicate with external Bluetooth controllers or virtual devices using the standard HCI socket interface.

The CVSS score is not published, and no EPSS or KEV entry is available, making it difficult to quantify the risk precisely. However, the flaw allows an out-of-bounds read that could expose kernel memory to a local or remote attacker who can generate or spoof malformed Bluetooth events. The likelihood of exploitation depends on the attacker’s ability to control the Bluetooth controller or to target a system that has a vulnerable kernel connected to a rogue Bluetooth device. Because the kernel reads directly from a user-controlled packet without bounds checking, the vulnerability could be exploited by readily available tools that can send crafted Bluetooth HCI events. If not mitigated, this could lead to information disclosure or pave the way for further privilege escalation.