The Linux kernel’s b43legacy wireless driver reads a firmware‑controlled key index in the RX path. Because the original warning macro did not enforce bounds in production builds, an attacker could cause an out‑of‑bounds read of the driver’s key array, potentially exposing kernel memory. The recent patch adds an enforcing check that discards frames with invalid indices, eliminating the direct read vulnerability.

All Linux kernel versions that include the b43legacy driver before the patch commits are affected, including the 7.1 release candidates rc1 and rc2 as referenced by the CPE data, and older kernels containing the unpatched driver code.

An attacker who can send crafted wireless packets may trigger the driver to read beyond the allowed key index, leading to memory disclosure. The CVSS score is 7.8, indicating a high severity, while the EPSS score is under 1% and the vulnerability is not listed in the CISA KEV catalog. The exploit requires wireless communication with the vulnerable device, and there is no evidence of a public exploit yet. Upgrading to the patched kernel eliminates the out‑of‑bounds read and mitigates the risk.