The Linux kernel's mac80211_hwsim driver has a flaw where virtual queue report lengths are passed directly to skb_put(), causing out‑of‑bounds writes when a backend reports a length larger than the allocated skb. This triggers skb_over_panic() and crashes the host, leading to service disruption while existing frames remain usable. The weakness is a buffer overflow of the buffer tailroom (CWE‑787).

This issue affects Linux kernel builds that include the hwsim module before the fix, across all vendors that ship the kernel. No specific version numbers are listed, so any deployment using an unpatched hwsim should be considered vulnerable.

The vulnerability can be triggered by any virtio device that misreports the RX ring length, a scenario that can arise in virtualized environments hosting untrusted guests or custom hardware. The EPSS score is less than 1%, and the CVSS score of 5.5 indicates moderate severity, while the lack of a KEV listing does not diminish its potential to cause a host crash when exploited. This is a denial of service that requires an update to prevent host failure.