The Linux kernel’s mac80211 subsystem contains an error in the defragmentation routine for multi‑link element (MLE) and reconf frames stored in non‑transmitted profiles. When the routine runs, it incorrectly uses a pointer to a defragmented copy together with a pointer to the original elements, which may result in parsing beyond the intended buffer. This heap buffer overrun can corrupt memory allocated to the kernel, potentially causing the process to crash or the entire system to lose stability. The vulnerability is identified as a Wrong pointer value (CWE‑823).

All Linux kernel builds that include the vulnerable mac80211 defragmentation code are affected. The issue exists in mainline kernels prior to the inclusion of commit 1f573e17bcb7275ddd1c8f47f46ae0faf0e902a4 or later, regardless of distribution vendor.

The CVSS score of 8.3 indicates a high severity; however, the EPSS score is reported as < 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting a low likelihood of active exploitation in the near term. The likely attack vector is remote via crafted Wi‑Fi frames transmitted to the target device, which is inferred from the fact that the flaw occurs during parsing of Wi‑Fi frames. If exploited, an attacker could induce a denial of service or cause undefined behavior through kernel memory corruption, but no explicit privilege escalation is stated in the provided description.