The kernel bug involved the nl80211 subsystem parsing beacon frames. When a beacon had fewer RNR entries than MBSSID entries, nl80211_parse_beacon() rejected the excess RNR data but did not free the memory allocated for that data. Because the rejected allocation was never attached to the beacon data, it remained allocated, leading to a memory leak that could grow with repeated malformed frames. This flaw corresponds to CWE‑590, which concerns the failure to release allocated memory.

Affected systems encompass all Linux kernel releases that include the nl80211 driver code before the applied patch. The vendor is Linux. No specific version numbers are listed, so any kernel up to the date of the patch may be vulnerable.

The CVSS score is not provided, and the EPSS score is unavailable, while the vulnerability is not listed in the CISA KEV catalog, indicating a low probability of widespread exploitation. Nonetheless, a local attacker that can inject crafted beacon frames—such as a rogue Wi‑Fi access point or a malicious device on the same wireless network—could trigger the kernel to leak memory repeatedly. Over time this could degrade system performance or cause a kernel panic if the memory exhaustion becomes severe.