The btrtl Bluetooth driver in the Linux kernel contains an integer underflow that occurs when parsing a malformed firmware patch. If the patch length is shorter than expected, the subtraction can underflow, turning a copy operation into an oversized read and write during the firmware installation process. This results in kernel memory corruption and can crash the system or potentially allow an attacker to gain elevated privileges. The weakness is a classic integer-overflow leading to a buffer overflow scenario, aliased as CWE-680 and CWE-122.

All Linux kernel instances that implement the btrtl Bluetooth driver are vulnerable, regardless of distribution. No specific version range is provided, so any kernel release that includes the unpatched btrtl code before the referenced commit is susceptible.

An attacker would need to deliver a crafted firmware patch over the Bluetooth interface. The vulnerability can trigger on 32‑bit architectures where arithmetic wraparound is possible, increasing the likelihood of exploitation on such systems. While no EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog, the potential for kernel memory corruption and elevation of privileges means the risk is high if the target device accepts external firmware updates. Disabling Bluetooth or the btrtl driver is a mitigative step until a patch is applied.