The btrtl Bluetooth driver in the Linux kernel contains an integer underflow bug that occurs when parsing a malformed firmware patch. If the provided patch length is shorter than the expected version field, the subtraction used to calculate the copy size underflows, transforming what should be a bounded copy into an oversized read and write. This memory corruption can corrupt kernel data structures, potentially crash the system or allow an attacker to gain elevated privileges.

All Linux kernel installations that include the unpatched btrtl driver are affected, regardless of distribution. The vulnerability exists in any kernel release that contains the btrtl code prior to the commit that added the patch length bounds check. No specific version range is listed, so any build with the original code is susceptible.

The likely attack vector is the delivery of a crafted firmware patch over the Bluetooth interface, inferred because the flaw is triggered during firmware parsing. Because the vulnerability can trigger on 32‑bit architectures where arithmetic wraparound is possible, devices using such architectures are more vulnerable. The EPSS score of <1% indicates a low but nonzero probability of exploitation, while the CVSS score of 7.8 reflects high severity. The vulnerability is not listed in CISA KEV, so it is not known to be actively exploited in the wild at this time. Disabling Bluetooth or the btrtl driver mitigates the risk until a kernel update is applied.