The Linux kernel’s mac80211 Wi‑Fi subsystem contains a slab‑out‑of‑bounds read in the function that selects a queue for monitoring traffic. When an AF_PACKET frame large enough to become non‑linear is received on a monitor‑mode interface, the code checks skb->len—counting both linear and non‑linear data—before indexing skb->data. If the 802.11 header begins in a non‑linear fragment, a read past the end of the allocated head buffer occurs, exposing kernel memory contents. The vulnerability is therefore an information‑disclosure flaw stemming from improper bound checking, classified as CWE‑125.

All Linux kernels that compile the mac80211 subsystem with monitor‑mode support are susceptible. The fix was introduced in the commit identified by 63e7064b4c1c4b540bf2f0cba47384f92ab95307 and related siblings. Administrators should assume that any kernel release that predates this commit is vulnerable until the patch is applied.

The base CVSS score of 6.1 indicates medium severity. Exploitation requires an attacker capable of injecting crafted AF_PACKET frames into a monitor‑mode interface; the attack is thus local or requires privileged network access. The EPSS score of less than 1% and the absence from CISA’s KEV catalog suggest that active exploitation is currently low, but the potential for information leakage remains. Prompt patching is advisable to eliminate the read flaw and mitigate the risk.