The Linux kernel wifi Libertas driver incorrectly handles monitor mode frames that are shorter than expected. It casts the buffer to a radiotap header, skips the header, then copies the destination address from an offset without verifying that the buffer is large enough. This out‑of‑bounds read can expose kernel memory contents to an attacker who can supply a crafted frame, and the leaked data could potentially aid in a local privilege escalation or further exploitation. The vulnerability does not require any elevated privileges to trigger; an attacker with access to the wireless interface in monitor mode can send the offending frame.

The flaw exists in the Libertas wireless driver within the Linux kernel. Vendor: Linux. No specific kernel release is listed in the CVE data, so any kernel version that contains the original driver code before the documented patch may be affected.

The CVSS score is not provided in the data, but the EPSS score is unavailable and the vulnerability is not included in CISA’s KEV catalog. The risk remains significant because the flaw permits kernel memory disclosure and could be leveraged by a local attacker with access to the monitor interface. Exploitation would likely occur by sending a short monitor frame to the device, and the driver would read past the skb bounds. Without an active exploit in the wild, the risk level is moderate to high, emphasizing the importance of patching as soon as possible.