A fault in the Bluetooth Intel driver of the Linux kernel allows 0xFF record lengths to be interpreted as signed values, causing them to wrap. When crafted records are parsed, this can lead to a buffer overflow or other memory corruption during firmware write operations, potentially enabling an attacker who supplies malformed DDC payloads to gain arbitrary code execution.

The vulnerability resides in the generic btintel driver that ships with the core Linux kernel. Any installation that includes this module—regardless of distribution or kernel build—is susceptible. Versions released before the fix are affected, and no specific version range is quoted in the advisory.

The CVSS score of 4.4 classifies the flaw as low‑moderate severity, and the EPSS "< 1 %" rating indicates a very low estimated probability of exploitation in the wild. The flaw remains listed in the CISA KEV as not applicable. Attackers would need proximity to the target and control over the Bluetooth DDC firmware update channel to exploit the bug. Successful exploitation would exploit a memory corruption bug that could lead to arbitrary code execution, but the availability of a patch means risk can be mitigated immediately.