A critical out-of-bounds read vulnerability in the Linux kernel Bluetooth stack allows unauthenticated adjacent attackers to potentially expose sensitive memory contents.

The vulnerability exists due to incorrect buffer length calculations during the processing of Bluetooth Service Data fields. An unauthenticated attacker within proximity can send a specifically crafted periodic advertising payload to trigger an out-of-bounds read, potentially causing memory leakage to user space via the getsockopt system call.

Successful exploitation of this vulnerability can lead to the unauthorized disclosure of sensitive kernel memory. Given the CVSS score of 8.1, the risk is high: an attacker can potentially extract cryptographic material or other sensitive data residing in kernel memory, leading to a significant compromise of system confidentiality.

Immediate Action: Update the Linux kernel to version 6.12.109, 6.18.50, 7.2.4, or a later stable release provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for unusual Bluetooth stack errors or crashes related to hci_conn processing, which may indicate attempted exploitation.

Compensating Controls: If patching is not immediately feasible, disable the Bluetooth subsystem if it is not required for system operation to eliminate the attack vector.

Public Exploit Available: Unknown

This vulnerability represents a significant security risk to systems utilizing Bluetooth functionality. Administrators should prioritize the application of kernel security updates to the specified versions or newer to remediate this flaw. Failure to patch may expose kernel memory to adjacent attackers, potentially facilitating further system compromise.