The Linux kernel Bluetooth driver btmtk_usb_hci_wmt_sync() function improperly handles WMT event response packets by casting SKB data to fixed-size structures without validating the packet length. This can cause out-of-bounds reads from the SKB tailroom when the firmware response is shorter than expected. The fix involves validating and advancing the SKB data pointer using skb_pull_data() to ensure sufficient data is present before accessing the base event header and additional status fields.

This vulnerability can lead to out-of-bounds memory reads in kernel space, which may cause denial of service (system crashes) or potentially expose sensitive kernel memory contents. The CVSS vector indicates local attack vector with low complexity and no user interaction required, with high confidentiality and availability impact but no integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid running untrusted Bluetooth firmware or inputs that could trigger this vulnerability. Monitor vendor channels for updates and apply patches promptly once released.