The function wfx_hif_read_mib() copies reply->length bytes into a caller buffer without confirming that reply->length does not exceed val_len. A firmware response with a larger length field causes a memcpy that overruns the caller buffer and can corrupt kernel memory. This unchecked copy is a classic kernel buffer overflow that can lead to privilege escalation or denial of service once memory corruption occurs.

Linux kernel implementations that use the wfx wireless firmware driver are affected. The flaw exists in the Linux:Linux family of kernel source trees and may impact any device that loads the wfx driver and communicates with Wi‑Fi firmware. No specific kernel version range is given in the CVE data, but all earlier versions lacking the validation are vulnerable.

The vulnerability can be triggered by a crafted firmware response to the wfx driver. An attacker who can influence the Wi‑Fi firmware or radio interface could corrupt kernel memory, potentially enabling kernel‑level code execution or a denial of service. The EPSS score of < 1% indicates a very low likelihood of exploitation, and the CVSS score of 5.5 denotes a medium‑severity flaw. The vulnerability is not listed in the CISA KEV catalog, so precise prevalence remains unclear, but the risk is still significant for systems that load the affected driver and accept untrusted firmware.