important · Bluetooth — Linux BNEP
Linux's June BNEP short-frame fix left additional peer-controlled out-of-bounds reads.
Affects
Linux kernel Bluetooth BNEP networking, used by Linux PAN clients and access points.
A peer with an established Bluetooth PAN session can send truncated data, control, filter or extension frames; the remaining paths read beyond the logical skb, and one control form can fall through to Ethernet delivery.
Detail and 2 sources
The correction has been merged upstream, but we do not know whether the old behavior yields an observable disclosure, reliable crash, memory corruption or control-flow effect on a hardened distribution kernel.