The Linux kernel Bluetooth driver btmtk_usb_hci_wmt_sync() function previously cast WMT event response SKB data directly to struct btmtk_hci_wmt_evt and struct btmtk_hci_wmt_evt_funcc without verifying that the SKB contained enough data. This could cause out-of-bounds reads from the SKB tailroom when the firmware response was shorter than expected. The fix involves using skb_pull_data() to validate and advance past the base WMT event header and, for the FUNC_CTRL case, pulling additional status field bytes before accessing them, preventing memory safety issues.

The vulnerability allows out-of-bounds memory reads in the Bluetooth driver, which can lead to information disclosure and potentially cause denial of service due to memory corruption. The CVSS vector indicates local attack vector with low complexity and low privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and high availability impact.

A fix is available in Linux kernel versions 7.0.0-28.28.1 and later. Users should upgrade to these or newer kernel versions to remediate the vulnerability. No additional mitigations are indicated by the vendor advisory.