In the Linux kernel’s rsi Wi‑Fi driver, a miscalculated offset in the key‑removal routine causes an out‑of‑bounds memset that writes 144 bytes past the end of the skb buffer, corrupting unrelated heap objects. This flaw is an out‑of‑bounds write (CWE‑787). The corruption can trigger a kernel crash, and consistent exploitable weaknesses of this type can lead to privilege escalation or denial of service if an attacker can force the key removal path.

All Linux kernel releases that include the unpatched rsi Wi‑Fi driver are vulnerable. The patch was introduced in a recent commit to the kernel source; therefore any system with a kernel build containing the rsi driver before that commit is at risk. No specific kernel version range is listed, so users should verify the presence of the fix against the kernel’s commit history.

The CVSS score of 5.5 indicates a moderate severity. The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalogue, implying a low observed exploitation probability. The likely attack vector is local: a user or process that can initiate key removal, interface teardown, or roaming will trigger the bad memset. While no public exploit exists, the nature of the buffer overflow makes it a potentially severe flaw if an attacker gains the ability to repeatedly invoke the driver with crafted conditions.