The flaw allows unprivileged local users to retrieve 802.15.4 LLSEC keys through a generic netlink interface in the legacy IEEE802154_NL family. The kernel builds LLSEC dump entries without any admin permissions, so when an LLSEC_LIST_KEY request is issued, the raw 16‑byte AES‑128 key is written into the netlink reply. This leaks the secret used for encrypting and authenticating frames, compromising the confidentiality and integrity of the wireless link. The underlying weakness corresponds to CWE‑201 (Improper Access Control) and CWE‑862 (Authorization Bypass Through User‑Controlled Critical Parameter).

All Linux kernel configurations that include the ieee802154 module and expose the legacy netlink interface are affected. Based on the description, it is inferred that many mainstream distributions ship this module by default, so systems running the stock kernel may be impacted. No specific kernel version ranges are enumerated; the vulnerability exists in all revisions prior to the commit that introduces IEEE802154_DUMP_PRIV for LLSEC dump operations.

Exploitation requires only local, non‑privileged access; an attacker only needs to open an AF_NETLINK socket to NETLINK_GENERIC and request the legacy LLSEC dump command. The CVSS score of 7.1 indicates moderate severity, while the EPSS of less than 1% reflects a low but non‑zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet, but the lack of an admin gate makes it a significant local risk for systems that rely on 802.15.4 security.