The kernel function ieee80211_s1g_check_tim parses a Partial Virtual Bitmap of a received TIM element. It incorrectly calculates an end pointer two bytes beyond the element payload, allowing the parsing loop to read up to two bytes outside the element boundary. This out‑of‑bounds read of adjacent skb or heap memory can expose kernel memory contents, thereby enabling information disclosure.

All Linux kernel builds that include the unpatched mac80211 S1G Wi‑Fi code are affected; no specific version range is provided in the CVE data.

The vulnerability is an out‑of‑bounds read triggered by a crafted Wi‑Fi management frame containing a malformed TIM element. The attack requires the ability to inject such frames directly to the target device, so it does not apply to remote IP‑based exploitation. The CVSS score of 5.5 indicates moderate risk, while the EPSS score of < 1% suggests a low yet nonzero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the read can leak arbitrary memory adjacent to the TIM element, potentially revealing sensitive kernel data. Consequently the risk may be moderate for systems that enable S1G Wi‑Fi and receive traffic from untrusted sources.