The vulnerability originates in the Linux kernel Bluetooth Intel PCI driver where the packet length variable plen is an unsigned 16‑bit integer. The length is calculated as a header size added to the packet data length. For ACL/ISO frames, the data length field is also 16 bits, so values close to the maximum integer value wrap around, causing the calculated plen to be smaller than the actual packet length. This bypasses a verification check that the socket buffer length is less than plen, allowing skb_trim() to trim the packet. An attacker can send a crafted packet that triggers this overflow, resulting in kernel packet truncation or corruption and prompting a denial of service.

Affected systems are all Linux kernel builds that include the btintel_pcie driver before the patch was applied. The driver is present in the kernel package of most Linux distributions. The vulnerability exists in any kernel that contains the function btintel_pcie_recv_frame() without the 2026‑98731 fix. The provided commit hashes point to the upstream changes that introduced the 32‑bit plen calculation.

The CVSS score is 6.5, the EPSS score is <1%, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a Bluetooth link to the target device and the ability to inject a crafted ACL/ISO packet that overflows the plen calculation. The absence of public exploit code and the need for low‑level packet crafting suggests that widespread exploitation is unlikely, though targeted attacks by insiders or adversaries with physical or wireless proximity could succeed, leading to service interruption from kernel socket buffer truncation.