This vulnerability allows a remote attacker to trigger an out-of-bounds read in the Linux kernel’s WiFi subsystem by sending a malicious beacon containing a truncated EHT Multi‑Link Element (MLE). The flawed code incorrectly assumes the MLE is a standard form and only checks length before accessing internal fields, leading to a memory read that can expose data or crash the kernel, thereby compromising confidentiality or availability but not providing direct code execution.

All Linux kernel deployments that include the cfg80211 WiFi stack and have not yet applied the patch that validates the EHT MLE type and size. This includes any distribution kernel versions that have not backported the fix; no specific version range is listed.

The CVSS score of 8.1 and an EPSS score of less than 1% indicate a moderate‑to‑high risk of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need to position a rogue access point within wireless range, and the exploited host must process the beacon, so the attack is confined to devices on the same WiFi network and does not require privileged access on the target machine.