A bounds‑check omission in the mac80211 Wi‑Fi subsystem allows a malicious Wi‑Fi 7 access point to send a crafted EPCS Enable Response frame that contains a link_id value of 15. Because link_id 15 falls outside the 15 valid indices in sdata->link, the kernel performs an out‑of‑bounds read that feeds a garbage pointer to ieee80211_sta_wmm_params, leading to a NULL‑pointer dereference and a kernel crash. The flaw is a NULL‑pointer dereference (CWE‑476) and results in a system‑wide denial of service.

All Linux kernel builds that include the unpatched ieee80211_ml_epcs code are affected. The vulnerability applies to mainline kernels from the point the function was introduced until it was fixed in the commits referenced in the supplied Git URLs. Devices with Wi‑Fi 7 (802.11be) enabled and EPCS active are exposed, regardless of the system’s user privileges.

The CVSS score of 8.8 indicates high severity and the EPSS score of < 1% suggests a very low probability of current exploitation. The vulnerability is not listed in CISA’s KEV catalog. It is inferred that an attacker must control a nearby Wi‑Fi 7 access point to inject malicious EPCS frames; no privileged access is required beyond local wireless traffic. If exploited, the kernel will crash, causing a service interruption and possibly a reboot, impacting endpoints, servers and embedded devices that use the affected kernel.