TID-To-Link Mapping (TTLM) elements in the Linux mac80211 subsystem sometimes lack a presence indicator when a default mapping is used, causing the driver to incorrectly parse the frame and read one byte beyond the element’s end. This results in an out-of-bounds read (CWE-125), which could allow an attacker to glean unintended kernel data or, if repeated, lead to instability.

The flaw exists in all Linux kernel implementations that include the mac80211 driver before the patch, notably the 6.19 release series (rc1 through rc7) and any downstream kernels that have not yet incorporated the fix. All Linux distributions relying on these kernels are affected.

The CVSS score of 5.5 indicates a moderate impact, and the EPSS score of less than 1% suggests a low current exploitation likelihood. The vulnerability is not listed in CISA’s KEV catalog. Attackers could exploit the flaw by transmitting specially crafted wireless frames to a victim system, making the attack vector likely remote over the wireless network. Because the issue requires only the presence of a malformed TTLM element, a legitimate attack would need control over the message stream or the ability to inject frames.