The vulnerability is a null pointer dereference in the mac80211 mesh channel switch frame handling. When a mesh peer receives a crafted channel switch action frame that omits the optional Mesh Channel Switch Parameters element, the kernel dereferences a NULL pointer and crashes. The weakness is a classic null dereference (CWE‑476). The result is a kernel panic that brings the host down, creating a denial‑of‑service condition. No privilege or authentication is needed beyond an established open mesh link.

This flaw exists in the Linux kernel for all releases since version 3.13. The bug was confirmed on kernel 6.17.0‑5‑generic and affects any system that uses the mac80211 subsystem with wireless mesh support. The affected products are identified as “Linux: Linux Kernel” and are represented by the CPE string “cpe:2.3:o:linux:linux_kernel:*:…”. Every installation of the kernel that contains mac80211 and has mesh enabled is potentially vulnerable unless patched.

The probability of exploitation, according to EPSS, is less than 1 % and the vulnerability does not appear in CISA’s KEV catalog, indicating a low likelihood of widespread attack. Nevertheless, the impact of a kernel crash is severe. An attacker would need to establish a mesh link with the target and send a malicious channel‑switch action frame; no additional authentication is required. Because the flaw is a kernel panic, the path to exploitation is straightforward, but because it is limited to wireless mesh traffic, the attack surface is more niche. The official patch adds a NULL check and is available in the latest kernel releases, so the recommended mitigation is to update the kernel as soon as possible.