The flaw occurs in the Linux kernel’s Wi‑Fi stack for the RSI911x chipset. When the driver fails to set the size of the per‑interface driver data, memory allocated for an interface is too small. A subsequent write to the driver’s private structure overflows the bounds of the ieee80211_vif object, corrupting kernel memory. The corruption can cause a kernel crash when the interface is toggled, leading to a denial‑of‑service condition. The vulnerability is classified as a heap buffer overflow (CWE‑787).

The issue affects Linux distributions that ship with the 6.19 release candidates—rc1 through rc6—when they use the unpatched RSI911x driver. Any system that has not applied the commit referenced in the kernel’s stable series and that loads the RSI911x module is at risk, regardless of vendor or distribution.

The CVSS score of 7.8 indicates high severity. The EPSS score is below 1 %, implying a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Based on the described trigger, the most likely attack vector requires a user with the ability to invoke the link configuration commands (“ip link set … up/down”) on a machine that runs the affected driver. This typically limits the threat to a local privileged user or a compromised root process; no remote‑based exploitation path is documented.