The flaw lies in the libipw driver’s handling of beacon and probe‑response Wi‑Fi management frames. When a frame shorter than the expected 36‑byte header arrives, the driver subtracts the size of a full beacon from the reported frame length using unsigned arithmetic, causing a wraparound to a very large value. This erroneous length is then passed to an information‑element parser that reads almost 64 KiB from a buffer that physically contains only the 24‑byte header. The out‑of‑bounds read exposes kernel memory and can trigger a kernel crash, thereby compromising confidentiality, integrity, and availability.

Any Linux system that ships with the libipw driver for the ipw2100 or ipw2200 Wi‑Fi chipsets is vulnerable until the patch is applied. The vulnerability is present in all kernel releases that compile the libipw module without the reject‑short‑beacon fix, regardless of distribution or kernel variant.

The EPSS score of < 1% indicates a very low but non‑zero probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The attack requires only that an attacker broadcast a crafted short beacon or probe‑response frame over the local wireless network. The lack of authentication or encryption for management frames makes the attack trivial for a threat actor within radio range, potentially leading to a denial‑of‑service or kernel‑memory disclosure if the parser is triggered repeatedly or combined with other weaknesses. The CVSS score of 7.1 reflects a high severity level.