Based on the description, it is inferred that an attacker could send specially crafted DPMAIF PIT header packets to the affected interface to trigger the flaw. The vulnerability occurs when the t7xx Wi‑Max driver indexes an internal array with a five‑bit netif index from a packet header, but no bounds check is performed. The array holds only 21 entries, while the index can range up to 31. When an index of 21 or higher is encountered, the driver reads past the end of the array into the adjacent callback table that is never NULL. It then interprets whatever data resides there as a valid driver structure and dereferences it, leading to kernel memory corruption and the potential for arbitrary code execution.

All Linux kernel installations that include the t7xx Wireless Wide Area Network driver and have not yet incorporated the commit that inserts the bounds check. The issue applies to any kernel where the t7xx driver is compiled, regardless of the major kernel version, the driver code lives in the network stack and the patch was merged into the mainline repository.

Based on the description, it is inferred that an attacker could send malformed DPMAIF PIT header packets to the affected wireless interface to trigger the flaw. The CVSS score is 7.0 and no public exploits are listed, but the nature of an out‑of‑bounds read that can lead to arbitrary kernel code execution presents a high impact on confidentiality, integrity, and availability. The EPSS score is <1%, and the vulnerability is not included in the CISA KEV catalog. An attacker who can transmit specially crafted DPMAIF PIT header packets to the affected wireless interface can trigger the flaw. Because the driver processes inbound traffic, the attack can be launched remotely from the local network or from a connected device, making the risk significant for systems exposing the t7xx interface.