In the Linux kernel, an out‑of‑bounds read occurs in the wcn36xx wireless driver when processing a short trigger BA firmware response. The driver only checks that the response length matches sizeof(*rsp) (20 bytes) but, if a candidate count of one or more is present, it reads an additional 22‑byte candidate structure from the buffer without verifying the data is present. This misread corrupts the background activity session state, potentially leading to denial of service or improper handling of wireless sessions. The weakness is a classic buffer overread (CWE‑214).

The affected vendor is Linux kernel deployments using the wcn36xx wireless driver. The vulnerability applies to any kernel build that includes the unpatched wcn36xx module; no specific version ranges are listed in the CVE data, so all kernels before the commit that introduced the fix are potentially impacted.

EPSS data is not available and the vulnerability is not listed in the CISA KEV catalogue, so there is no known widespread exploitation activity yet. The CVSS score is not specified in the provided data, but based on the nature of the bug the potential impact is high due to the likelihood of session state corruption and possible denial of service. Attackers would need to influence the firmware response data sent to the driver, which could be achieved by a malicious access point or compromised firmware. Because the flaw involves an out‑of‑bounds read rather than a write, immediate code execution is unlikely, but the integrity of wireless sessions is at risk if the defect is triggered.