The vulnerability occurs in the btintel_pcie driver when it processes device‑supplied DMA descriptors. A 16‑bit field controlled by the PCIe device, frbd_tag, is used as an array index with no bounds checking. The driver array has only 64 entries, while the field can take any value up to 65535, allowing an attacker to dereference an out‑of‑bounds pointer and corrupt kernel memory. Additionally, the driver can enter an infinite loop if the device supplies a cr_hia value that is out of range, which may further destabilize the system.

The flaw affects the Linux kernel’s Bluetooth implementation on all mainstream distributions that compile the btintel_pcie driver. No specific version numbers are listed, so any kernel build that includes this driver prior to the fix is potentially vulnerable.

Because the driver runs in kernel space, successful exploitation can lead to arbitrary code execution with root privileges. The EPSS score is not available and the flaw is not listed in CISA’s KEV catalog, but kernel vulnerabilities with unchecked array indices are typically considered high‑risk. Attackers would need physical or firmware‑level control over a PCIe Bluetooth device to supply malicious DMA indices, a scenario that is realistic for compromised hardware or attacks on embedded systems with Bluetooth connectivity.