An insufficient validation of Individual Target Wake Time frames in the Linux mac80211 subsystem allows a truncated TWT setup frame to be processed. The kernel code accepts a frame whose length field is shorter than the size of the full ieee80211_twt_params structure and passes this truncated data to the driver. Based on the description, it is inferred that the driver may read beyond the intended buffer, causing kernel memory corruption and potentially a crash; if an attacker can influence the contents, there is a possible, but not proven, path to arbitrary code execution. The impact is kernel memory corruption.

All Linux kernel installations that include the mac80211 wireless stack and provide the S1G Target Wake Time feature, and that have not incorporated the patch commits referenced in the advisory, are affected. The advisory does not list specific kernel versions, so any kernel lacking those commits is presumed vulnerable.

The CVSS score of 8.8 indicates severe severity, while the EPSS score of less than 1% suggests a low probability of exploitation at this time. The CVE is not listed in the CISA KEV catalog. The likely attack vector is a Wi‑Fi device within range that can transmit crafted TWT frames; based on the description, it is inferred that a nearby attacker could trigger the vulnerability by sending such frames. No public exploit has been reported, but kernel memory corruption makes it a serious risk if malicious frames can be delivered.