The bug is an out‑of‑bounds read in the WiFi driver libipw of the Linux kernel. In libipw_rx() the code attempts to read the WEP key index by accessing skb->data[hdrlen + 3] after only verifying that skb->len is at least hdrlen + 3. This allows a local attacker to read a byte just beyond the packet header. The flaw does not alter key index semantics but can expose sensitive kernel data and is classified as a buffer over‑read (CWE-125).

All instances of the Linux kernel that include the legacy libipw WiFi driver are affected. Any deployment that uses a kernel older than the commit that adds the bound check will be vulnerable. The patch is available from commit 062840bdc9ee06169b3c371bf66711f1d7ec0bf4 onward.

The likely attack vector involves an attacker on the same local wireless network sending a specially crafted WiFi frame that causes libipw_rx() to read beyond the packet header. The EPSS score of less than one percent and the absence of a KEV listing suggest a low probability of exploitation at present, while the CVSS score of 5.5 indicates medium severity. The vulnerability permits only an information disclosure of kernel memory; it does not provide a path to code execution or privilege escalation.