The Linux mac80211 wireless stack did not fully validate extension frames before passing them to the generic RX path. The generic RX logic can read regular header address fields even when an unsupported extension subtype is present, which can lead to memory corruption or kernel crashes. The vulnerability is specifically related to the handling of S1G beacon extension frames and can be triggered by malformed frames that overload the RX processing logic.

All Linux kernel builds that include the unpatched mac80211 module are potentially vulnerable. No specific kernel versions are listed in the advisory, so any kernel release containing the vulnerable code before the current patch may be affected. The fix applies to all Linux distributions that use mac80211 as the wireless driver framework.

The CVSS score of 8.8 indicates high severity, and the EPSS score of < 1% suggests a very low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is the transmission of crafted extension frames over a wireless interface to trigger the improper header handling. Successful exploitation would likely lead to kernel instability or a crash, resulting in a denial of service. The risk is therefore primarily availability and kernel integrity rather than privilege escalation or data exfiltration.