The vulnerability resides in the iwlwifi wireless driver of the Linux kernel. The driver incorrectly used a loop counter instead of the actual TID value when indexing the tid_data array during a block‑ack notification. This oversight allowed a write of lq_color to an unintended array slot, potentially corrupting kernel memory. The CVE notes that, prior to the patch, the counter was always zero so the corruption did not impact the intended block‑ack entry.

Linux kernels that incorporate the iwlwifi driver without the out‑of‑bounds check commit are affected. The issue was fixed in the commit referenced in the CVE description; any kernel version prior to that commit is vulnerable. No specific vendor or version numbers are enumerated beyond the Linux kernel.

The CVSS score is 8.8, indicating high severity. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, so the publicly known exploit likelihood is unknown. Deploying malicious Wi‑Fi frames that trigger a block‑ack notification would be the likely attack vector, which is inferred from the context of the bug but not explicitly stated in the advisory. No public proof‑of‑concept or exploit has been published.