The kernel driver for Wilc1000 Wi‑Fi devices incorrectly handles the length of an association response. The routine deserialises the fixed header without first verifying that the reported payload length is at least the size of the header. For responses shorter than the expected six‑byte header, the subtraction of the header length from the total length wraps around, producing a very large positive value that is then used to copy upwards of 65 000 bytes beyond the valid data. This out‑of‑bounds read can expose kernel memory or trigger a crash, thereby compromising confidentiality or availability of the host. Other short responses can also read beyond the bounds of the status code field, reinforcing the read vulnerability.

The flaw affects Linux kernel builds that include the wilc1000 wireless driver. All running systems that load this driver are impacted until a patched version is applied. No specific upstream kernel version numbers are listed in the supplied data, so any kernel variant with the wilc1000 driver compiled in should be considered vulnerable.

The CVSS score is 8.3 and the EPSS score is < 1%, and it is not listed in the CISA KEV catalog, indicating that no widespread exploitation has been reported at the time of this analysis. Based on the description, it can be inferred that the flaw is exploitable through a crafted wireless association response that an untrusted access point can send to a target device. An attacker could, for example, create a rogue AP that issues a short association response as part of a DoS or data‑exfiltration attempt against devices that use this driver. The lack of a known exploitation but the presence of a kernel read fault suggests a moderate‑to‑high risk for environments where the driver is active and exposed to wireless traffic.