An off‑by‑one bounds check in the btintel_pcie Bluetooth driver allows an attacker to use an index equal to the transaction queue count to access internal arrays. This can lead to kernel memory corruption, potentially exposing sensitive kernel data or altering execution state. The flaw is limited to the privileged code path of the driver, and while the official description does not explicitly state the ultimate impact, such a bug is capable of enabling privilege escalation or remote code execution if an exploit is crafted.

All Linux kernel installations that include the btintel_pcie Bluetooth driver for Intel PCIe adapters are affected. The flaw applies to any kernel build where this driver is enabled; the specific kernel versions are not enumerated in the CVE data, so any kernel containing the buggy code up to the resolution commit should be considered vulnerable.

The EPSS score of <1% and its absence from the CISA KEV catalog suggest that the vulnerability is not currently widely exploited. Based on the description, the likely attack vector is a local attacker executing privileged Bluetooth commands that trigger the out-of-bounds access. However, the CVSS score of 7.0 signifies a high severity level, and the nature of an off‑by‑one array index is known to cause severe kernel exploits. In practice, the risk is theoretical until an attacker develops an exploit, but the potential damage if exploited would be significant.