An out‑of‑bounds write in the Linux kernel’s mac80211 wireless subsystem occurs when processing the ML Reconfiguration element of an IEEE 802.11 frame. The link_id field can be 15, but the link_removal_timeout array contains only 15 entries indexed 0‑14. Writing to index 15 corrupts the stack, potentially overwriting kernel data structures and allowing an attacker to execute arbitrary code with kernel privileges. This vulnerability is a classic CWE‑129 (unchecked new) and CWE‑787 (out‑of‑bounds write) that can lead to privilege escalation.

The flaw exists in the upstream Linux kernel before the commit that added the bounds check. All distributions shipping kernels without the fix, including kernel versions 6.5 and earlier, 7.0‑rc1 and later, are vulnerable. Any system that enables the 802.11 stack on a wireless interface is affected; devices that never load the mac80211 driver are not impacted.

The CVSS score of 8.8 indicates high severity, though the EPSS score is below 1%, so exploitation has not yet been widely observed. The vulnerability can be triggered by sending a specially crafted ML Reconfiguration frame over a Wi‑Fi network that the target device is connected to; proximity to the victim may be required. Because it results in a kernel stack overflow, the exploit can give an attacker full control of the system. The vulnerability is not in CISA’s KEV catalog, but the lack of public exploits does not mitigate the need for prompt remediation.