The Linux kernel’s carl9170 Wi-Fi driver reads firmware responses and copies the data into a read buffer without validating that the reported length matches the buffer size. When the firmware sends a length that exceeds the driver’s allocated buffer, the memcpy copies more bytes than the buffer can hold, causing an out-of-bounds write. This memory corruption can overwrite critical kernel data, lead to a driver crash, or trigger a kernel panic. Although the flaw does not immediately grant code execution, it creates a serious data integrity and availability risk within the wireless subsystem.

All Linux systems that load or support the carl9170 Wi-Fi driver are exposed. The fault exists in the driver code itself; it is not confined to a particular kernel release line and will affect any configuration that includes this driver.

An attacker would need to influence the firmware’s response to the driver, which means having control over the wireless device or its firmware. The CVSS score of 5.4 denotes moderate severity, and the EPSS score of < 1% indicates very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Given the limited attack surface and low probability, the risk is primarily local; nonetheless, memory corruption could cause service disruption, making timely patching advisable.