The libipw_michael_mic_verify() function in the Linux kernel incorrectly assumes that every Technical Key Integrity Protocol (TKIP) frame contains an eight‑byte Michael Message Integrity Code (MIC). When a TKIP frame is truncated, the unsigned payload length calculation overflows, causing michael_mic() to read beyond the socket buffer. This out‑of‑bounds read allows an attacker to view portions of kernel memory, potentially leading to information disclosure or kernel instability if combined with other weaknesses.

Any Linux system that includes the libipw wireless driver and has not yet incorporated the patch is vulnerable. The vulnerability affects all kernels that ship with libipw prior to the commit that adds the MIC presence check and enforces the correct MIC length. No specific kernel versions are enumerated in the advisory.

The EPSS score is below 1 %, indicating a very low probability of exploitation. The CVE is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker can trigger the issue by sending a specially crafted TKIP frame over a wireless interface. This does not require local user interaction, making the attack remote and network‑based. The CVSS score of 5.5 indicates moderate severity.