The Linux kernel Bluetooth component hci_le_create_big_complete_evt() improperly iterates over bis_handle entries without verifying the index against the number of BIS entries, causing out-of-bounds reads into adjacent heap memory. When the event contains fewer bis_handle entries than the number of BT_BOUND connections or num_bis=0, the function reads invalid data that leads to rejection of the connection handle but leaves the connection in BT_BOUND state. This causes hci_conn_hash_lookup_big_state() to repeatedly find the same connection, resulting in an infinite loop while holding the hci_dev_lock. The fix involves terminating the BIG if all BIS cannot be properly established.

The vulnerability can lead to out-of-bounds memory reads and an infinite loop within the Bluetooth kernel code, causing denial of service by locking the device's Bluetooth subsystem. Confidentiality impact is high due to out-of-bounds reads, but integrity is not affected. Availability is impacted due to the infinite loop causing a hang or resource exhaustion in the Bluetooth driver.

A fix is available in Linux kernel versions 7.0.0-28.28.1 and later. Users should update to a patched kernel version to resolve this vulnerability. Since this is a kernel-level issue, applying the official kernel update from the vendor is the recommended remediation.