In the Linux kernel, an out‑of‑bounds read occurs in mac80211’s IEEE 802.11 Mesh Extension code when parsing an empty PREQ element; the driver attempts to read a byte beyond the declared payload before validating the presence of fixed‑header data, exposing a small portion of kernel memory. The flaw does not currently lead to documented code execution or privilege escalation, but the kernel data leakage could aid further attacks such as privilege escalation or influencing kernel state. The weakness is solely a one‑byte over‑read bug exercised by malformed mesh frames.

The flaw affects all Linux kernels that include the legacy mac80211 Wi‑Fi stack and were built before the commit that moves the size check for empty PREQ elements. Any system running an upstream kernel without this patch is vulnerable, including distributions that ship the default linux_kernel source. Distribution back‑ports may or may not contain the fix; users should verify their kernel revision and apply an update when vendors provide a patched kernel module.

The EPSS score is less than 1 %, indicating a very low exploitation probability, and the vulnerability is not listed in CISA KEV. With a CVSS score of 5.5, the overall risk is moderate. Exploitation requires an attacker to inject crafted mesh frames into the wireless network that the vulnerable driver will process. The attack vector is network‑based, specific to the wireless interface, and no remote exploitation tests have been reported. While the single‑byte read exposes kernel memory, the potential for exploitation exists but its impact is constrained to information disclosure.