The Linux kernel’s libipw driver processes Wi‑Fi association response frames. In libipw_handle_assoc_resp(), the driver calculates the length of the information element by subtracting a fixed‑size header (sizeof(*frame)) from the frame length stored in a 16‑bit unsigned field (stats->len). Because the subtraction is performed using the size_t type, a frame that is shorter than expected causes the arithmetic to wrap around instead of yielding a negative value. The resulting large value is cast back to a 16‑bit length for the parser, which then reads beyond the bounds of the receive buffer. This kernel buffer over‑read can expose arbitrary kernel memory contents to an attacker. The flaw also involves an under‑read (CWE‑125) due to miscalculating the IE length, which can cause the parser to read past the buffer boundaries. The CVE description does not mention any direct privilege escalation, only the potential for sensitive data leakage.

This flaw affects all Linux kernels that contain the libipw driver for the ipw2100 and ipw2200 Wi‑Fi chipsets. It is independent of vendor or distribution; any Linux system shipping a kernel with these drivers and not yet updated to the patched version is susceptible. Distributions that ship a kernel before the fix and do not override the driver with a hardened version are impacted.

The CVSS score of 7.1 indicates medium‑high severity. The EPSS score is less than 1 %, showing a low, but non‑zero, probability of exploitation. The flaw is not listed in the CISA KEV catalog, so no documented exploits exist yet. Based on the description, an attacker must be able to send malformed Wi‑Fi frames to the target device. The vulnerability exploits a wrap‑around in unsigned arithmetic in the driver; while exploitability depends on the attacker’s ability to transmit frames, the kernel’s lack of bounds checking makes the impact serious if bypassed. The risk remains significant despite the low exploitation probability.