The Linux kernel driver for the wcn36xx Wi‑Fi chipset was found to use an unvalidated firmware‑controlled count as the bound when indexing a flexible array within a message. A firmware message that reports a count larger than the actual data allows the driver to read beyond the allocated buffer size, exposing kernel memory contents. This out‑of‑bounds read can leak sensitive data and potentially serve as a foothold for further attacks. The weakness is classified as an out‑of‑bounds read vulnerability.

Any system running a Linux kernel with the wcn36xx wireless driver and the PRINT_REG_INFO feature enabled is potentially affected. The specific kernel version or distribution is not identified in the CVE data, but the vulnerability applies to all kernels that have not incorporated the patch that bounds‑checks the rsp->count field.

The CVSS score of 8.1 indicates high severity, while the EPSS score is < 1%, indicating a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves an attacker sending a crafted message to the wireless firmware – which could be achieved remotely over the air or locally if the attacker can influence the firmware’s message content – resulting in an out‑of‑bounds read of heap data. Although the conditions for exploitation are specific, the impact of leaking kernel memory makes this flaw potentially high‑impact if exploited.