The Linux kernel Bluetooth component btrtl contained a vulnerability in the rtlbt_parse_firmware() function where it copies patch_length - 4 bytes before appending the firmware version. If a malformed firmware patch shorter than the version field is provided, the subtraction can underflow, resulting in oversized memory read and write operations. Furthermore, the patch_offset + patch_length check can wrap on 32-bit architectures, allowing invalid patch lengths to pass validation. The fix involves validating the patch length and range without arithmetic overflow before allocating or copying the patch to prevent memory corruption.

This vulnerability can cause out-of-bounds memory reads and writes during Bluetooth setup, potentially leading to memory corruption. Such corruption could affect system stability or security, depending on how the corrupted memory is used. However, no known exploits in the wild have been reported.

A fix for this vulnerability has been implemented in the Linux kernel to properly validate firmware patch bounds and prevent arithmetic underflow and overflow conditions. Users should apply the official kernel updates that include this patch once available. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor or Linux kernel advisories for the current remediation status and apply updates accordingly.