The Linux kernel's Bluetooth MGMT_OP_ADD_EXT_ADV_DATA command handler did not properly validate that the lengths of advertising and scan response data were within the bounds of the command payload. This allowed a short command to cause an out-of-bounds read in add_ext_adv_data(), passing an invalid pointer to tlv_data_is_valid(). If the out-of-bounds memory is accessible, it could be copied into the advertising instance and later read back by the caller. The vulnerability requires CAP_NET_ADMIN privileges and was detected by KASAN as an 8-byte slab-out-of-bounds read. The fix involves rejecting commands whose length does not match the fixed header plus both advertising data lengths before processing the data.

An attacker with CAP_NET_ADMIN privileges in the initial user namespace could exploit this vulnerability to cause an out-of-bounds read in kernel memory. This could lead to information disclosure of kernel memory contents via Bluetooth advertising data. There is no indication of code execution or privilege escalation from the provided data. No known exploits are reported in the wild.

A fix has been implemented in the Linux kernel to reject malformed Bluetooth MGMT_OP_ADD_EXT_ADV_DATA commands with invalid length fields before parsing the data. Users should apply the official Linux kernel updates that include this fix. Since this is a kernel vulnerability, updating to a patched kernel version is the recommended remediation. No additional mitigations are indicated by the vendor advisory.