In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btintel: fix buffer over-read in btintel hw error()

The "Exception info %s" print uses skb->data + 1, but the 12-byte payload is not guaranteed to be NUL-terminated and can be read past its end.

Bound the print with "%.*s" and skb->len - 1.