In the Linux kernel’s wireless driver, the function that scans an RSN/WPA element in a Wi‑Fi beacon reads the pairwise‑cipher count directly from the element supplied by an attacker and uses that count to walk a list of OUIs. The count is never bounded against the actual length of the element, allowing an attacker to craft a beacon with a largewise count that causes the driver to read past the end of the duplicated beacon buffer. This out‑of‑bounds read of kernel memory can disclose sensitive data when the host scans any nearby access point. The weakness is a classic memory bounds‑checking failure, corresponding to CWE‑125.

The flaw resides in Linux kernel releases that include the mwifiex wireless driver. The vendor information lists the generic Linux kernel and no specific version range is provided, meaning any recent kernel with mwifiex support is impacted.

The EPSS score of < 1% indicates a very low but nonzero exploitation probability, and the vulnerability is not listed in CISA's KEV catalog. The CVSS score of 7.0 indicates a medium to high severity. Though no public exploit is known, the mechanics only require the host to process a malicious Wi‑Fi beacon, which is feasible on local wireless networks. The likely attack vector is an attacker transmitting a crafted RSN/WPA IE within a beacon or probe‑response that a victim device scans. The out‑of‑bounds read exposes kernel data, potentially revealing confidential information, but does not grant code execution or privilege escalation. The overall risk depends on the sensitivity of the leaked kernel contents.