The ath5k wireless driver performs an array‑index out‑of‑bounds write: the index 4 is written into a four‑element array, overwriting the following buffer member. The write alters a status field (ack_signal) but does not trigger a denial of service or obvious information leakage. Because the driver runs in kernel space, this flaw constitutes a memory corruption condition that could theoretically be manipulated through crafted wireless frames. The primary impact is a potential data integrity issue within the driver’s state structures. Based on the description, it is inferred that the vulnerability is triggered by maliciously crafted wireless frames that cause the driver to write beyond the bounds of its rate array.

Affected systems are all Linux distributions that ship a kernel containing the ath5k driver. The vulnerability is present in any build that has not applied the commit that adds a bounds check before the write. No specific kernel version range is listed, so all kernels prior to the fixed release are susceptible.

The CVSS score of 8.3 demonstrates a high severity memory corruption condition. The EPSS score is < 1%, indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker sending crafted wireless traffic to trigger the out‑of‑bounds write (based on the description, this is inferred). In the absence of a publicly available exploit, the risk is considered moderate, though the high CVSS indicates serious potential to corrupt kernel memory and affect driver state integrity.