An out-of-bounds write occurs when the mac80211 subsystem processes the ML Reconfiguration element of an IEEE 802.11 frame; the link_id field can be 15 while the link_removal_timeout array only has 15 entries (indices 0‑14), so writing at index 15 corrupts stack memory. This memory corruption can overwrite kernel data structures and potentially be leveraged to execute arbitrary code with kernel privileges.

The flaw is present in the Linux kernel’s wireless stack. All distributions that ship the upstream kernel without the committed bounds‑check are affected. No specific kernel versions are listed in the advisory, so any kernel before the fix commit can be considered vulnerable.

The CVSS score of 8.8 signals high severity, and though the EPSS score is below 1%, the risk remains significant. The likely attack vector is a malicious Wi‑Fi frame containing an ML Reconfiguration element with an out‑of‑range link_id; an attacker on the same wireless network could send such a frame to trigger the exploit. The vulnerability is not in CISA’s KEV catalog, however the absence of known exploits does not reduce the urgency of applying the patch.