The Linux kernel's eir_create_adv_data() function constructs Bluetooth advertising data in a fixed-size buffer of 31 bytes for the legacy path. It prepends a 3-byte Flags AD structure but does not verify if the combined size of the Flags and the user-supplied advertising data fits within the buffer. This results in a stack out-of-bounds write when memcpy copies adv_data_len bytes plus the 3-byte Flags into the fixed buffer. The flaw is triggered locally by users with CAP_NET_ADMIN privileges on LE-only controllers. The fix involves only prepending the Flags structure when it fits alongside the advertising data, dropping the Flags if insufficient space exists rather than the user data.

Exploitation of this vulnerability can lead to memory corruption on the kernel stack, potentially causing system instability, crashes, or privilege escalation. The vulnerability affects confidentiality, integrity, and availability (C:H/I:H/A:H) of the system. However, exploitation requires local access with CAP_NET_ADMIN privileges and an LE-only Bluetooth controller on the legacy advertising path.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability has been resolved in the Linux kernel source, so applying the latest kernel updates when available is recommended. Until then, restrict CAP_NET_ADMIN privileges to trusted users and avoid using LE-only controllers with legacy advertising paths if possible.