The btintel_pcie driver performs an unchecked memory copy of traffic packet data into a fixed 4096‑byte DMA buffer. Oversized packets are rejected only in a later routine, so callers of the earlier send_sync function may silently overflow the buffer, corrupting kernel memory. The overflow can destabilise the system or provide an attacker with a sandbox for executing arbitrary code with kernel privileges.

Any Linux kernel edition that includes the btintel_pcie Bluetooth driver is potentially affected. No specific kernel version is identified, so all builds with this driver should be considered at risk until a patched kernel is applied.

The EPSS score is listed as < 1 %, indicating a very low probability of exploitation. The CVSS score of 7.0 reflects moderate severity. The vulnerability is not currently in the CISA KEV catalog, and no active exploits are reported. The likely attack vector is an adversary capable of sending crafted Bluetooth packets to the target host, which is inferred from the context of the driver flaw.