This vulnerability allows any local user to issue a generic netlink request to the legacy IEEE802154_NL family and retrieve a dump of LLSEC security keys without privilege checks. The dump operation writes the raw 16‑byte AES‑128 key directly into the netlink reply, effectively exposing the secret key that authenticates and encrypts 802.15.4 frames. The disclosed key compromises both confidentiality and integrity of the wireless link. This is a classic information‑exposure flaw, identified as CWE‑200 – Exposure of Sensitive Information to an Unauthorized Actor.

The flaw resides in the Linux kernel’s IEEE802154 networking code. Any distribution using the stock kernel that contains the ieee802154 module is potentially affected. No specific kernel version ranges are listed in the CVE data, so the vulnerability is considered present in all kernels that have not yet incorporated the listed patch commits.

The exploitability is straightforward for an attacker with a local, non‑privileged user account. The attack requires only the ability to open an AF_NETLINK socket to the GENERIC NETLINK family and request the legacy LLSEC dump command, which the kernel currently permits without any administrative flags. Because the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, the likelihood of widespread exploitation cannot be quantified precisely, but the local nature and lack of safeguards make this a high‑risk condition for systems that rely on 802.15.4 security.