The vulnerability is a NULL pointer dereference (CWE‑476) in the mwifiex driver’s TDLS handling routine. When a Wi‑Fi access point advertises HT capabilities but omits the HT operation element, the driver interprets the capability data as present and later dereferences a null pointer, causing the kernel to crash. The crash results in an immediate denial of service to the affected host, potentially bringing the entire system down or requiring a reboot.

Any Linux system that uses the mwifiex wireless driver is potentially affected. Versions of the kernel that lack the commit adding the NULL check are vulnerable; no specific release numbers are listed, so apply the newest patched kernel from the distribution or upgrade to a release that includes the fix.

The flaw can be triggered by an attacker who can populate a malicious access point that presents HT capabilities but no HT operation element. A client device that attempts to establish a TDLS link with that access point will dereference a null pointer and crash. The attack vector is remote over a wireless network; the victim device need only associate with a rogue Wi‑Fi access point. The CVSS score of 5.5 classifies this as a medium severity vulnerability, yet the kernel crash allows the attacker to cause a denial of service to the host. The EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The flaw is not listed in CISA KEV catalog.