The Linux kernel driver for the ath6kl Wi‑Fi chip incorrectly assumes that the length fields supplied by the firmware are bounded by the buffer. At a connect event, the beacon_ie_len, assoc_req_len, and assoc_resp_len values can total up to 765 bytes, exceeding the available WMI event data and triggering an out‑of‑bounds read. This read can corrupt internal state such as wmi->is_wmm_enabled, which may lead to a denial of service or unpredictable kernel behaviour. The flaw exemplifies incorrect buffer validation (CWE‑805).

This issue affects all Linux kernel releases that deploy the ath6kl Wi‑Fi driver without the patch. No specific kernel versions are listed in the advisory, so any distribution using an unpatched ath6kl driver is vulnerable.

Based on the description, the likely attack vector is local or device‑centered, requiring the attacker to interact with the device’s Wi‑Fi firmware during a connect event. The CVSS score of 8.3 indicates high severity, but the EPSS score of less than 1% shows a very low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Although remote code execution is not explicitly documented, the memory corruption could potentially be leveraged by a privileged user to destabilise the system. Overall, the risk remains moderate due to the low exploitation probability yet significant impact if triggered.