The iwlegacy driver in the Linux kernel allocates memory for EEPROM configuration data when a 3945 PCI Wi‑Fi device is probed. If the device is subsequently removed, the driver fails to free this memory, allowing the data to persist in a location that can be accessed after removal. This creates a local information‑disclosure flaw that can expose configuration or key material stored in the EEPROM to any user or process that can read the leaked memory. Based on the description, it is inferred that the leaked EEPROM data could potentially reside in a memory region that is still accessible to processes after the device removal, enabling local users to read the data.

The flaw is present in any Linux kernel that includes the iwlegacy Wi‑Fi driver and supports the iwl3945 module. No specific kernel version range is listed, so any distribution using the upstream kernel where the probe succeeds and the remove path does not free the EEPROM memory is potentially affected. All standard Linux distributions employing the upstream kernel are at risk unless a patch is applied.

The EPSS score is below 1% and this vulnerability is not listed in CISA’s KEV catalogue, indicating no known public exploitation. Based on the description, it is inferred that removing the PCI Wi‑Fi device requires privileged access (e.g., root or system‑administrator rights). A CVSS score of 2.3 reflects a low‑impact information disclosure, with no code execution or privilege escalation capability; the overall threat remains moderate to low, but systems with highly confidential EEPROM contents may wish to patch promptly.