The Linux kernel driver for the Carl9170 Wi‑Fi adapter contains an off‑by‑two bounds check in the TX status handler. This allows an attacker to read two additional entries past the end of the _tx_status array when firmware supplies a hdr.ext value larger than hdr.len/2, exposing kernel memory that should be protected. The resulting kernel memory leak can disclose sensitive data and may enable further privilege escalation. The weakness corresponds to CWE-125.

All Linux kernel builds that ship the carl9170 driver and have not incorporated commit 423c836f9 are affected. This includes any distribution or vendor kernel before that commit. Administrators on any Linux system running the Carl9170 driver should verify the driver version and kernel revision to determine whether they are still running the vulnerable code.

The CVSS score of 5.9 indicates moderate severity, and the EPSS score of less than 1% demonstrates a very low probability of exploitation at present. Exploitation requires the attacker to control the wireless firmware or send specially crafted frames, limiting the attack surface to environments with physical access or compromised firmware. The vulnerability is not listed in the CISA KEV catalog. While the current impact is confined to kernel memory disclosure, a reliable trigger could serve as a stepping stone for kernel compromise or privilege escalation.