In the Linux kernel through 6.2.8, net/bluetooth/hci_sync.c allows out-of-bounds access because amp_init1[] and amp_init2[] are supposed to have an intentionally invalid element, but do not.
5.13.0-19.194.13.0-16.195.3.0-18.195.3.0-24.265.4.0-9.126.5.0-9.95.19.0-1007.7~22.04.15.19.0-1009.9~22.04.15.19.0-1010.10~22.04.15.19.0-1011.11~22.04.15.19.0-1012.12~22.04.15.19.0-1013.13~22.04.15.19.0-1014.14~22.04.15.19.0-1015.15~22.04.14.15.0-1001.16.5.0-1008.85.13.0-1005.65.3.0-1003.35.3.0-1008.95.3.0-1009.105.3.0-1010.115.4.0-1005.55.0.0-1021.24~18.04.15.0.0-1022.25~18.04.15.0.0-1023.26~18.04.15.0.0-1024.27~18.04.15.0.0-1025.285.0.0-1027.30Exploitability
AV:NAC:LPR:NUI:NScope
S:UImpact
C:LI:NA:NCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N