The vulnerability lies in the Linux kernel's Bluetooth driver for Intel devices, specifically btintel_hw_error(). A print statement concatenates string data from skb->data+1 without ensuring null‑termination, enabling an over‑read. The 12‑byte payload may be read past its actual length, exposing kernel memory contents to a local or possibly remote attacker.

The flaw exists in all Linux kernel configurations that load the btintel driver. It affects the Linux kernel, as represented by the cpe entry for the entire kernel. No specific version list is provided; any kernel that incorporates the unpatched btintel code is vulnerable.

Based on the description, the likely attack vector is establishing a Bluetooth connection that triggers the btintel_hw_error path; the attacker would then have a local user or could potentially use a remote device depending on driver exposure. The CVSS score is 3.4, and the EPSS score is < 1%; the issue is not part of the CISA KEV catalog. Given the low CVSS score, the severity is considered low, though an out‑of‑bounds read in kernel code remains a potential risk. The vulnerability only reads memory, which could be used for information disclosure or possibly to destabilize the kernel.