In the Linux kernel, btintel_pcie_send_frame() copies packet data into a fixed DMA buffer of 4096 bytes using memcpy() without validating the packet size. A user‑space process with HCI_CHANNEL_USER access can craft an oversized packet, causing a buffer overflow that corrupts kernel memory. This overflow can potentially lead to kernel crashes or arbitrary code execution, compromising system integrity.

The vulnerability affects any Linux kernel that includes the btintel_pcie Bluetooth driver before the bug was fixed. All users of Intel PCIe Bluetooth adapters on Linux are potentially impacted. No specific kernel version range is provided, but the patch has been committed in recent kernel releases.

The flaw requires a process that can obtain HCI_CHANNEL_USER rights, which is typically a local privilege or application level capability. Because the EPSS score is unavailable and the CVE is not in the KEV catalog, the overall exploitation probability is uncertain, but the ability to overflow a kernel buffer represents a high‑risk vulnerability. If an attacker can drive a user application to send the crafted packet, kernel stability could be compromised, and with further manipulation, privilege escalation might be possible. The attack vector is likely local with elevated privileges; the CVSS score, if calculated, would likely be in the high range.