In the Linux kernel, an out‑of‑bounds read flaw in the Bluetooth BNEP frame handling routine can allow a local attacker to read memory beyond the intended bounds, potentially leaking kernel or user data. This vulnerability was fixed by ensuring sufficient packet length checks before accessing headers and by preventing fall‑through during control frame processing. The weakness corresponds to an unchecked read of memory outside allocated bounds (CWE‑788) and could expose sensitive information (CWE‑200).

The defect affects all Linux kernel versions that include the BNEP subsystem. No specific version range is listed in the advisories, so any kernel running in an environment with Bluetooth BNEP enabled could be vulnerable until patched.

Because the flaw involves reading beyond the bounds of an Ethernet frame or BNEP control frame, exploitation requires that the attacker can deliver crafted frames to the kernel's network stack, likely through the local Bluetooth interface. The lack of an EPSS score and absence of a KEV entry means the public threat intelligence community has not yet reported active exploitation, but the kernel bug could be leveraged by a local attacker with sufficient privileges. The overall danger level cannot be precisely quantified without a CVSS score, but the potential for kernel information disclosure motivates prompt remediation.