In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btrtl: validate firmware patch bounds

rtlbt_parse_firmware() copies patch_length - 4 bytes before appending the
firmware version. A malformed firmware patch shorter than the version field
can make this subtraction underflow and turn the copy into an oversized
read and write during Bluetooth setup.

The existing patch_offset + patch_length check can also wrap on 32-bit
architectures. Validate the patch length and range without arithmetic
overflow before allocating or copying the patch.

https://git.kernel.org/stable/c/39e01b4addfbbe177567d6ed1dfb81f9cccb19e6

https://git.kernel.org/stable/c/609c5b04a28dc1b0f3af6a7bc93055135b2d2059

https://git.kernel.org/stable/c/6744ab60dfac55d1df5733960aad5be300984301

https://git.kernel.org/stable/c/68c5a2a19987c035eb129e627e579adafb04f637

https://git.kernel.org/stable/c/83534891c058ed71e251135072640911670869aa

https://git.kernel.org/stable/c/a4cb830e0b55ac76c849fd7840afb251f4c028fa

https://git.kernel.org/stable/c/bda3c598ade6ea03884074b91e31608326684921

https://git.kernel.org/stable/c/f1ca750c0510bdbb504bf084d2f196ef2af92ea6

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/bluetooth/btrtl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"db33c77dddc2ed2cff3061d0b096a9f5ab0c3647","lessThan":"39e01b4addfbbe177567d6ed1dfb81f9cccb19e6","versionType":"git","status":"affected"},{"version":"db33c77dddc2ed2cff3061d0b096a9f5ab0c3647","lessThan":"bda3c598ade6ea03884074b91e31608326684921","versionType":"git","status":"affected"},{"version":"db33c77dddc2ed2cff3061d0b096a9f5ab0c3647","lessThan":"a4cb830e0b55ac76c849fd7840afb251f4c028fa","versionType":"git","status":"affected"},{"version":"db33c77dddc2ed2cff3061d0b096a9f5ab0c3647","lessThan":"68c5a2a19987c035eb129e627e579adafb04f637","versionType":"git","status":"affected"},{"version":"db33c77dddc2ed2cff3061d0b096a9f5ab0c3647","lessThan":"83534891c058ed71e251135072640911670869aa","versionType":"git","status":"affected"},{"version":"db33c77dddc2ed2cff3061d0b096a9f5ab0c3647","lessThan":"6744ab60dfac55d1df5733960aad5be300984301","versionType":"git","status":"affected"},{"version":"db33c77dddc2ed2cff3061d0b096a9f5ab0c3647","lessThan":"f1ca750c0510bdbb504bf084d2f196ef2af92ea6","versionType":"git","status":"affected"},{"version":"db33c77dddc2ed2cff3061d0b096a9f5ab0c3647","lessThan":"609c5b04a28dc1b0f3af6a7bc93055135b2d2059","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/bluetooth/btrtl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.2","status":"affected"},{"version":"0","lessThan":"4.2","versionType":"semver","status":"unaffected"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc4","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]