A user‑supplied radiotap header field can cause an unchecked bit‑shift in the mac80211 driver, producing undefined behaviour that leads to a kernel crash. The bug occurs when the IEEE80211_RADIOTAP_ANTENNA value, an 8‑bit flag taken directly from a packet, is used as a shift amount. If the shift count exceeds the size of the unsigned long type, a UBSAN warning is triggered and the kernel can fault, causing a denial of service. No remote code execution or privilege escalation has been reported; the impact is a local system crash if an attacker can inject a malformed packet. The flaw also represents CWE‑1335 (Unchecked Shift).

All Linux distributions that ship a kernel with the mac80211 Wi‑Fi driver and include the unpatched ieee80211_parse_tx_radiotap function are affected. This spans the upstream kernel as well as any derivative kernels that have not yet incorporated the patch. No specific vendor or version list is provided, so any system running the current Linux kernel is potentially vulnerable until the kernel is upgraded.

The vulnerability’s severity of 7.6 and its undefined‑behavior nature combine to produce a high‑impact denial of service if successfully triggered. The EPSS score (< 1%) and the fact that the issue is not in CISA’s KEV catalog suggest that real‑world exploitation is unlikely. The likely attack vector is a local attacker who can inject crafted wireless frames on a system running a vulnerable kernel, typically via raw sockets requiring CAP_NET_RAW or similar privileges. This inference is based on the description that the defect is triggered by user‑supplied radiotap header data. The absence of a workaround means there is no low‑cost mitigation other than upgrading the kernel or limiting a user’s ability to send raw packets.