In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btintel: fix buffer over-read in btintel_hw_error()

The "Exception info %s" print uses skb->data + 1, but the 12-byte
payload is not guaranteed to be NUL-terminated and can be read past
its end.

Bound the print with "%.*s" and skb->len - 1.