A vulnerability in the Linux kernel Bluetooth driver (btnxpuart) could allow an adjacent attacker to cause a system crash or information disclosure.

The vulnerability exists in the nxp_process_fw_dump function, which fails to validate the length of firmware dump headers. An unauthenticated attacker in adjacent proximity can send a truncated frame, causing the kernel to read data beyond the allocated buffer and potentially trigger a premature controller reset.

Successful exploitation allows an attacker to disrupt Bluetooth communications and potentially induce a kernel panic, resulting in denial of service for the affected device. While the CVSS score of 7.1 reflects a high severity, the requirement for adjacent network access limits the attack surface to local wireless proximity. Nonetheless, for critical infrastructure utilizing Bluetooth for industrial or medical device control, this represents a significant risk to operational continuity.

Immediate Action: Update the Linux kernel to version 6.18.52, 7.2.6, or later versions where the fix is integrated.

Proactive Monitoring: Monitor system logs for Bluetooth driver errors or unexpected kernel resets related to the btnxpuart module.

Compensating Controls: If patching is delayed, disable the Bluetooth service or restrict physical access to the radio environment in sensitive areas to prevent adjacent proximity exploitation.

Public Exploit Available: Unknown

This vulnerability highlights the risk inherent in processing untrusted firmware dump data within the kernel space. Organizations should prioritize patching systems that rely on the btnxpuart driver, particularly in environments where Bluetooth-enabled devices perform critical tasks. Immediate deployment of the provided kernel updates is recommended to eliminate the risk of memory-based exploits and service disruption.