The vulnerability is a memory leak in the Linux kernel's mac80211 component, triggered when kmemdup fails during ieee80211_register_hw. The failure path skips rate_control_deinitialize, leaking rate control structures and consuming kernel memory. This can lead to gradual memory exhaustion, potentially causing system instability or a denial of service. The weakness is a classic memory leak, classified as CWE-401.

All Linux kernel versions before the patch, including releases from v6.13-rc1 through v7.1-rc7, that incorporate the mac80211 subsystem. The vulnerability impacts any host that loads a Wi-Fi driver relying on ieee80211_register_hw, regardless of the specific hardware.

No CVSS or EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector appears to be local or privileged, requiring control over a Wi-Fi driver or the ability to trigger a failure in kmemdup during device registration. While not immediately exploitable from a network perspective, an attacker with kernel modification or the ability to load custom drivers could repeatedly provoke the leak, gradually exhausting memory and causing service disruption. The risk is moderate, given the lack of public exploitation evidence but a clear path to denial of service once the condition is met.