The Linux kernel’s mac80211 subsystem contains a flaw where concurrent writes to the debugfs aql_enable file can cause the static_branch_dec function to underflow. This underflow corrupts the jump label mechanics, leading to a kernel crash and loss of service. The vulnerability manifests as an integer underflow (CWE‑191) and improper handling of atomic state changes (CWE‑367). The issue does not grant arbitrary code execution, but it can force a reboot or stall the system, effectively achieving a denial of service.

This problem affects the Linux kernel across multiple releases, including kernel 5.12 and all 7.0 release candidates from rc1 through rc7. Any distribution shipping one of these kernels without the later patch will be vulnerable. The static_branch_dec bug was observed in net/mac80211/debugfs.c and touches the aql_enable interface exposed via debugfs.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of active exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker needs local or privileged access to write to the debugfs aql_enable file; concurrent writes could trigger the underflow. Environments where debugfs is accessible to untrusted users or where aql_enable is heavily used face an increased risk of a kernel crash. The overall risk is moderate, constrained by the necessity for privileged local access and the need for concurrent operations.