The vulnerability resides in the Linux wireless driver wlcore: when a transmit packet fails to allocate sufficient headroom, the driver mistakenly interprets the failure as a full aggregation buffer. The code then enters a tight retry loop while holding wl->mutex and using atomic allocation, resulting in an infinite CPU‑tight loop and a soft lockup of the kernel. The primary effect is a denial of service that can degrade system responsiveness and stability. The weakness is a classic infinite loop (CWE‑835).

This issue affects the Linux kernel for versions 6.19 and the 7.0 release candidates 1 through 7. The patch that fixes the bug is present in later revisions of the 6.18.y backport series and is expected to be merged into the mainline.

With a CVSS score of 7.5 the vulnerability is considered moderately high severity, yet its EPSS score is less than 1% and it is not listed in the CISA KEV catalog, indicating low prior exploitation activity. The likely attack vector is the reception of wireless traffic that triggers a failure in headroom allocation; while the description does not state explicit prerequisites, it can be inferred that an attacker can potentially craft traffic to induce the failure without special privileges, resulting in the infinite loop. Cloud or local Wi‑Fi‑enabled systems remain at risk until the patch is applied.