The Linux kernel’s wireless driver for B43 devices contains an out‑of‑bounds read that is triggered by a key index supplied by the firmware during packet reception. When the reported index exceeds the 58‑entry array, the driver performs a non‑enforcing check and copies data beyond the array boundaries. This allows an attacker to read arbitrary kernel memory, potentially exposing confidential information.

The flaw affects any system running the Linux kernel with the b43 driver before the bound‑check enforcement is applied. No specific vendor release numbers are listed, so all Linux deployments that include this driver and have not yet applied the patch may be vulnerable.

EPSS information is not available and the vulnerability is not listed in the CISA KEV catalog, so a precise risk quantification cannot be provided. The attack vector is likely local or involves malicious firmware or crafted wireless traffic that provides an invalid key index. It is inferred that an attacker would need the ability to influence firmware or transmit crafted packets, but the fault is silent in production builds, increasing the potential impact for injected data.