The vulnerability arises from an off‑by‑one bounds check in the btintel_pcie Bluetooth driver, allowing an index equal to the queue size to be used. This permits access to one element past the end of the FRBD array, potentially reading or writing memory beyond accepted bounds. Such out‑of‑bounds access can corrupt kernel memory, leading to information disclosure or arbitrary code execution if the attacker controls the contents of the array and can influence the indices used during RX submission.

This flaw exists in the Linux kernel’s btintel_pcie module. Specific affected editions are not listed in the CVE data, so any kernel build that incorporates the unpatched btintel_pcie driver is potentially vulnerable.

The EPSS score is < 1%, indicating a very low probability of exploitation. The vulnerability is not known to be listed in the CISA KEV catalog, indicating no publicly known widespread exploitation yet. Likely attack vectors involve a malicious Bluetooth device or a local user with the ability to send crafted packets to the driver, as the flaw is triggered during receive queue processing. Given the kernel privilege level, successful exploitation could elevate privileges or compromise system integrity. The CVSS score is 7.0, indicating a high severity.