The vulnerability is a NULL pointer dereference in the mwifiex driver’s TDLS handling routine. When a Wi‑Fi access point advertises HT capabilities but omits the HT operation element, the driver interprets the capability data as present and later dereferences a null pointer, causing the kernel to crash. The crash results in an immediate denial of service to the affected host, potentially bringing the entire system down or requiring a reboot.

Any Linux system that uses the mwifiex wireless driver is potentially affected. Versions of the kernel that lack the commit adding the NULL check are vulnerable; no specific release numbers are listed, so apply the newest patched kernel from the distribution or upgrade to a release that includes the fix.

The flaw can be triggered by an attacker who can populate a malicious access point that presents HT capabilities but no HT operation element. A client device that attempts to establish a TDLS link with that access point will dereference a null pointer and crash. The attack vector is remote over a wireless network; the victim device need only associate with a rogue Wi‑Fi access point. Although a CVSS score is not published and EPSS is not available, the inability to bring a system down demonstrates a high severity denial‑of‑service risk. The flaw is not currently listed in the CISA KEV catalog.