An out-of-bounds read vulnerability in the Linux kernel ath6kl Wi-Fi driver allows adjacent attackers to potentially disclose sensitive memory or cause a system crash.

This flaw exists in the ath6kl_wmi_tx_complete_event_rx function, where the driver fails to validate the num_msg field against the actual WMI event buffer length. An unauthenticated, adjacent attacker can trigger this vulnerability by sending a specially crafted Wi-Fi frame that causes the driver to perform an out-of-bounds read of up to 1020 bytes.

Successful exploitation of this vulnerability could lead to the exposure of sensitive kernel memory, which may leak cryptographic keys or other protected information. Furthermore, the vulnerability can be leveraged to cause a denial of service through a system crash. With a CVSS score of 8.1, the high severity reflects the risk to system availability and data confidentiality in environments utilizing the affected Wi-Fi hardware.

Immediate Action: Apply the latest Linux kernel security updates provided by your distribution vendor, specifically ensuring the kernel is updated to at least version 5.10.265, 5.15.216, 6.1.183, or 6.6.148.

Proactive Monitoring: Monitor system logs for kernel oops or panic messages associated with the ath6kl driver, which may indicate attempted exploitation.

Compensating Controls: Restrict access to the wireless network environment to trusted devices only, as the attack vector requires the attacker to be in an adjacent network position.

Public Exploit Available: Unknown

Given the potential for kernel-level memory disclosure and system instability, organizations should prioritize patching affected Linux systems. Administrators should verify their current kernel version and apply the recommended patches immediately to mitigate the risk posed by this out-of-bounds read vulnerability.