The rsi Wi‑Fi driver in the Linux kernel performs unguarded copies of TX and RX MIC keys from fixed offsets within a key buffer when a key is loaded. Those offsets are defined only for TKIP keys, which use a 32‑byte layout. Keys from other ciphers, such as CCMP, are shorter and do not populate those byte positions. Consequently, the driver reads past the supplied buffer boundaries during a key load, resulting in an out‑of‑bounds read. This flaw allows an attacker who can supply a malformed key to potentially expose kernel memory contents, leading to information disclosure. No write or code execution path is indicated in the CVE description. The vulnerability is strictly a read violation; it does not claim or describe any overwrite or kernel crash.

The vulnerability affects Linux kernel builds that include the rsi Wi‑Fi driver module without the patch that restricts MIC key copying to TKIP only. Any distribution or custom kernel using rsi_hal_load_key before the fix is susceptible. No specific kernel version is cited, so any system with the unpatched rsi module is at risk.

The CVE has no publicly available exploit and is not listed in CISA KEV. The CVSS score is 5.5 and the EPSS score is < 1%, indicating a moderate severity and a very low but non‑zero probability of exploitation. Attackers would need to influence the key material presented to the rsi driver, which could occur through legitimate Wi‑Fi authentication or management traffic carrying a crafted key. Because the bug results in an out‑of‑bounds read, a successful exploitation could leak kernel memory, but there is no documented path to code execution or privilege escalation. The overall risk is primarily an information disclosure with an uncertain exploitation probability.