The btintel_pcie driver in the Linux kernel contains an integer overflow that permits the function btintel_pcie_prepare_tx() to use an index equal to txq->count to access the transmission descriptor and data buffer arrays before the index is wrapped modulo the queue count. Because txq->count is one past the end of the arrays, this oversight can lead to an out‑of‑bounds read or write, potentially corrupting kernel memory and enabling arbitrary code execution at kernel privilege level. The vulnerability is thus a critical out‑of‑bounds access that can compromise confidentiality, integrity, and availability of the affected system.

All Linux kernel releases that ship the btintel_pcie driver without the commit that introduces the bounds check are affected. The driver handles Bluetooth traffic for Intel PCIe controllers. The specific kernel version ranges are not provided in the data, but any kernel lacking the outlined patch is vulnerable.

The vulnerability could be triggered by a malformed Bluetooth transmission or by controlling the tx descriptor sequence. No EPSS score is available, so the exact exploitation probability cannot be quantified from the data. The vulnerability is not listed in the CISA KEV catalog, but its potential impact is high due to kernel privilege escalation. Administrators should consider the risk severe and apply the patch as soon as it becomes available.