A flaw in the Linux kernel’s cfg80211 subsystem lies in cfg80211_merge_profile(), which assembles Multi‑BSSID profiles from successive beacon elements. The loop inside the function never advances its mbssid_elem or sub_elem pointers, causing the same continuation to be re‑found and copied repeatedly. This results in the kernel performing the same data copy over and over, and a specially crafted beacon can trigger the loop to consume up to approximately 2 ms of CPU time per beacon. The effect is an increase in CPU usage that may degrade system responsiveness or, under sustained high traffic, lead to a denial of service. The weakness is a classic loop constraint error categorized as CWE‑835.

The vulnerability references the cfg80211 subsystem under the Linux kernel. The CPES string indicates that the flaw exists in any Linux kernel that includes this subsystem, but no specific version ranges are supplied. It is inferred that all kernel releases prior to the commit that introduced the fix are potentially affected, which would include mainstream distributions such as Ubuntu, Debian, Fedora, CentOS, as well as many embedded Linux devices. The exact product list is limited to Linux kernels, and version details must be verified against distribution release notes or kernel source tags.

The CVSS score of 7.0 classifies this vulnerability as moderate‑severity, but the EPSS score is below 1%, indicating a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, so it is not known to be actively exploited by threat actors. Based on the description, the attack vector is inferred to involve transmitting malicious Wi‑Fi beacon frames toward the target device. An attacker with the capability to broadcast crafted Wi‑Fi frames—such as a rogue access point or a device in proximity—can trigger the vulnerability by sending malicious beacon frames. The impact is primarily elevated CPU usage; exploitation would require sustained traffic to bring the host to a state of denial of service.