In the Linux kernel, btintel_pcie_send_frame() copies packet data into a fixed DMA buffer of 4096 bytes using memcpy() without validating the packet size. A user‑space process with HCI_CHANNEL_USER access can craft an oversized packet, causing a buffer overflow that corrupts kernel memory. This overflow can potentially lead to kernel crashes or arbitrary code execution, compromising system integrity.

The vulnerability affects any Linux kernel that includes the btintel_pcie Bluetooth driver before the bug was fixed. Any system that uses this driver is potentially impacted. No specific kernel version range is provided, but the patch has been committed in recent kernel releases.

The flaw requires a process that can obtain HCI_CHANNEL_USER rights, which is typically a local privilege or application level capability. Because the EPSS score of < 1% indicates an extremely low exploitation probability and the CVE is not in the KEV catalog, the overall exploitation probability is uncertain, but the ability to overflow a kernel buffer represents a high‑risk vulnerability. If an attacker can drive a user application to send the crafted packet, kernel stability could be compromised, and with further manipulation, privilege escalation might be possible. The attack vector is likely local with elevated privileges; the CVSS score of 6.7 indicates a moderate severity.