A buffer overflow occurs in the wilc1000 wireless driver when the RX transfer size reported by the device exceeds the 96 KiB buffer. The driver copies the full device‑reported size (up to 131 068 bytes) into rx_buffer without bounding the size itself, allowing an attacker‑controlled SDIO device to write up to 32 KiB beyond the buffer’s end. The overflow corrupts adjacent kernel memory, which could be exploited to gain kernel privileges or cause a system crash.

Linux kernel implementations that include the wilc1000 wireless driver are impacted. Any distribution that ships a kernel containing the vulnerable code and uses a wilc1000 SDIO device is at risk. The specific kernel versions are not listed, so all kernels with the legacy driver code should be checked for the applied commit that adds the transfer size validation.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of <1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local, with an attacker able to supply a malicious SDIO packet to trigger the OOB write. Successful exploitation could lead to kernel memory corruption, privilege escalation, or a denial‑of‑service condition.