The Libertas wireless driver in the Linux kernel incorrectly processes monitor mode frames that are shorter than expected. After casting the packet buffer to a radiotap header and omitting the header, the driver reads the destination address from an offset without verifying sufficient packet length, resulting in an out‑of‑bounds read that can expose kernel memory contents or trigger a system crash.

The flaw resides in the Libertas driver bundled with the Linux kernel. Any kernel release that contains the original driver code before the documented commit may be vulnerable, affecting all Linux distributions that ship the vulnerable kernel version.

The CVSS score of 4.4 indicates Low severity. The EPSS score of < 1% reflects a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker must be able to inject frames into the device’s monitor mode interface, implying local or remote access to the wireless hardware. The likely attack vector is allowing an attacker with such access to craft a short monitor frame to trigger the out‑of‑bounds read, which could leak sensitive kernel data or cause a crash. No active exploits are reported in the wild.