The Linux kernel Bluetooth btnxpuart driver had a vulnerability where nxp_process_fw_dump() read seq_num and buf_len fields from a firmware dump header without verifying the ACL payload length was sufficient. Since skb->len could be smaller than the expected 8-byte dump header, this led to out-of-bounds reads. The buf_len field controls dump termination, so a truncated frame could cause an early dump termination and controller reset. The fix involves using skb_pull_data() to validate and extract the firmware dump header safely, rejecting truncated frames.

This vulnerability allows an attacker with access to the Bluetooth controller interface to cause out-of-bounds reads in kernel memory, potentially leading to denial of service by resetting the Bluetooth controller. The CVSS score of 7.1 reflects a high severity with low attack complexity and no privileges required. There is no indication of information disclosure or code execution from the provided data.

A fix has been implemented in the Linux kernel to validate the firmware dump header length before accessing its fields, rejecting truncated headers. Users should apply the official kernel update containing this patch once available. No other mitigation is indicated.