In the Linux kernel, the ieee80211_process_rx_twt_action() function in the mac80211 stack does not fully validate the length of a received Individual Target Wake Time (TWT) setup frame. When the frame is shorter than the full ieee80211_twt_params structure, the function still forwards the data to drv_add_twt_setup() and the driver consumes the full block. This mismatch can lead to a kernel memory corruption because the driver processes bytes beyond the actual data. An attacker could exploit this by sending a malformed Wi‑Fi TWT frame, potentially crashing the kernel or enabling unauthorized actions.

All Linux kernel installations that include the mac80211 wireless subsystem and enable the S1G TWT functionality are affected. The disclosure does not specify particular kernel versions, implying any kernel code prior to the commit sequence that fixed the issue remains vulnerable, regardless of distribution.

There is no EPSS score or CVSS metric to quantify the likelihood or severity. The vulnerability is not listed in the CISA KEV catalog, and no public exploits are known. However, an attacker who can transmit specially crafted Wi‑Fi frames could trigger the kernel memory corruption because the driver trusts the length of the received TWT data. The exploit requires proximity to the target device and the ability to send native air‑time traffic, so the attack vector is local Wi‑Fi. Given the potential for kernel destabilization, the risk remains notable for exposed wireless environments while the exact exploitation probability is uncertain.