The vulnerability exists in the mwifiex wireless driver, where the function that processes 802.11 scan responses subtracts the size of fixed header and firmware‑supplied BSS information from the total response size without first validating that the resulting extent is within the bounds of the actual data. A short response or an oversized BSS length can cause an integer underflow, reducing the calculated TLV buffer size. This in turn allows the TLV parser to advance beyond the end of the command response and read or write memory that it should not access. The result is a kernel memory corruption that could lead to a crash, denial of service, or, if the attacker can exploit the corruption further, privilege escalation. The weakness is a classic integer underflow/buffer under‑read situation.

All Linux systems that build the kernel with the mwifiex wireless driver are affected. The driver is part of the mainline Linux kernel source tree, so any vendor that packages a recent kernel with mwifiex support is potentially impacted. No specific kernel version range is provided; all releases that include the unresolved code are vulnerable, and the fix appears in later commits of the stable kernel series.

The EPSS score is less than 1%, and the vulnerability is not listed in CISA’s KEV catalog, so there is no current evidence of widespread exploitation. The CVSS score is 7.0, indicating a high severity, and the nature of the weakness suggests potential for significant impact. The likely attack vector is remote: an attacker could broadcast a crafted Wi‑Fi scan response from a malicious access point or device to trigger the underflow on a target that scans for networks, or could use local firmware signals if the device can receive from an untrusted source. If the vulnerability can be reliably triggered, it exposes kernel memory and allows an attacker to compromise system integrity or availability.