The btintel_pcie driver processes DMA descriptors supplied by a PCIe Bluetooth device. A 16‑bit field named frbd_tag, fully controlled by the device firmware, is directly used as an index into a 64‑entry array without any bounds checking. Because frbd_tag can take any value from 0 to 65535, a malicious or malfunctioning device can write an out‑of‑range value, causing the driver to dereference a buffer outside the allocated array. This constitutes a buffer under‑read / out‑of‑bounds memory access (CWE‑125) and involves a signed‑to‑unsigned conversion misuse that allows the index to exceed its bounds. The same issue applies to cr_hia, which can also be set beyond the array size, potentially creating an infinite loop that destabilizes the system. These flaws can corrupt kernel memory, trigger crashes, or provide a foothold for privilege escalation.

This vulnerability is present in the Linux kernel’s Bluetooth implementation for Intel PCIe devices, specifically the btintel_pcie driver. No specific kernel versions are listed, so any Linux kernel build that contains this driver before the patch is potentially affected. All distributions or custom builds that compile the default btintel_pcie module are impacted.

The flaw is scored with a CVSS of 6.2, indicating moderate severity. The EPSS score of less than 1 % suggests a very low probability of exploitation in the current environment, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires that an attacker supply malicious DMA descriptors from a PCIe Bluetooth device, meaning physical access or device firmware manipulation is necessary. If executed, the impact could be a kernel crash, potential memory corruption, or privilege escalation to root.