In Linux kernel Bluetooth driver btintel_pcie, packet_len is read from the remote firmware header without a bounds check before passing it to skb_put_data. If packet_len is greater than the allocated RX buffer, the driver attempts to read memory beyond the buffer, producing an out‑of-bounds read. This can expose sensitive kernel memory or allow an attacker to trigger a crash, leading to denial of service or potential information disclosure.

The vulnerability affects any Linux system running the Linux kernel with the btintel_pcie Bluetooth driver enabled. Specific version ranges are not supplied, so any kernel that has not yet incorporated the correction in the referenced commit is susceptible.

The CVSS score of 5.5 indicates moderate severity, yet the presence of an out‑of‑bounds read raises the risk for exploitation. An EPSS score of <1% and lack of a KEV listing suggest low to moderate probability of exploitation, but the issue is publicly documented and can be triggered via malformed firmware. The likely attack vector involves malicious or incorrectly configured Bluetooth firmware sent to the device, or local manipulation of driver state by code with sufficient privileges. Given the nature of the flaw, exploitation is feasible for users with privilege to load malformed firmware or modify driver structures.