In the Linux kernel, the mac80211 Wi‑Fi subsystem incorrectly advances a parsing cursor for every Traffic ID (TID) even when the corresponding TTLM element is absent. This flaw constitutes a buffer‑overread (CWE-125). When the cursor is incremented past the end of the negotiated element, the parser reads beyond the allocated buffer, producing an out‑of‑bounds read. The over‑read data is gathered into internal structures but is gated before influencing driver state, so a malformed packet alone does not grant a direct privilege escalation. However, under particular allocator states the read can trigger a kernel fault or crash, potentially leading to denial‑of‑service.

All Linux kernel releases that ship the mac80211 Wi‑Fi firmware support before the fix are vulnerable. The affected vendor is the Linux kernel itself; distributions typically ship the kernel via their own packages, so any system running an unpatched kernel is at risk. No specific product name or version is listed, so affected systems must identify whether their kernel build contains the vulnerable code by checking the commit history or patch level.

The CVSS score of 8.1 denotes high severity. The EPSS score of less than 1% and absence from the CISA KEV catalog imply a low probability of exploitation in the wild, but the vulnerability can be triggered by a crafted 802.11 frame containing a malformed TTLM field. An attacker with network access to a Wi‑Fi client or access point can send such a frame to provoke the out‑of‑bounds read, potentially causing a kernel crash. No direct path to code execution or privilege escalation is documented, but the potential for denial‑of‑service makes it a concern for network‑critical deployments.