The bug allows the TX path of the cw1200 Wi‑Fi driver to read past the frame buffer and send the undefined padding bytes to the device. Up to 511 bytes of kernel heap data can be exposed with each transmitted frame, potentially leaking sensitive information from the kernel space. This is an out‑of‑bounds read that results in information disclosure (CWE‑200) and does not change the functional behavior of the driver, so it is unlikely to cause denial of service or direct code execution, but it does create a window for data leakage. The impacted data originates from the heap, so its exact contents depend on the system state at the moment of transmission.

All Linux kernel builds that ship the legacy cw1200 Wi‑Fi driver and use SDIO or SPI bus alignment are affected. The driver modules are part of the generic Linux kernel Wi‑Fi stack and are deployed on a wide range of consumer and industrial devices that use the Qualcomm cw1200 chipset. No specific vendor or product line is singled out in the advisory, but any device running the driver before the patch is potentially vulnerable.

The vulnerability has a CVSS score of 4.6 and is not listed in the CISA KEV catalog. Its EPSS score is <1%, indicating a low public exploitation probability, yet the failure is not trivial to mitigate externally. The attack is likely to be orchestrated by an attacker who can control a malicious Wi‑Fi device or inject malicious frames, allowing them to trigger the out‑of‑bounds read repeatedly and sample kernel memory. Because the driver only sends the padding bytes and not the actual frame payload, the attack surface is limited to leaking data rather than executing code, but the information disclosed could aid further attacks.