The vulnerability lies in the Linux kernel's Bluetooth driver for Intel devices, specifically btintel_hw_error(). A print statement concatenates string data from skb->data+1 without ensuring null-termination, enabling an over‑read. The 12‑byte payload may be read past its actual length, exposing kernel memory contents or potentially causing a crash.

The flaw exists in all Linux kernel configurations that load the btintel driver. It affects the Linux kernel, as represented by the cpe entry for the entire kernel. No specific version list is provided; any kernel that incorporates the unpatched btintel code is vulnerable.

The CVSS score is not publicly listed, and EPSS data is unavailable; however, the issue is not included in the CISA KEV catalog. Without a CVSS score, the precise severity is unclear, but an out‑of‑bounds read in kernel code is generally a medium to high‑risk flaw. The attacker would need access to a Bluetooth connection that triggers the btintel_hw_error path, which could be a local user or remote device depending on driver exposure. Since the vulnerability only reads memory, it could be used for information disclosure or potentially to destabilize the kernel.