The cfg80211_rx_assoc_resp() function copies the status and response‑IE fields from a Wi‑Fi association response before it verifies that the frame contains enough bytes for those fields. Because the copy occurs without a length check, a crafted frame that is shorter than expected triggers an out‑of‑bounds read. The kernel can read arbitrary data from memory, possibly causing a kernel crash or other kernel‑level denial of service. While the description does not state a guaranteed crash, the unchecked read is a classic buffer‑overread that can destabilize the system if it reaches a faulting path.

All Linux kernel builds that include the cfg80211 wireless subsystem are potentially vulnerable. The vendor list only indicates Linux, and no specific version range is documented. Therefore any unpatched kernel that incorporates the upstream cfg80211 code before the fix remains at risk.

The CVSS score of 8.8 classifies the issue as high severity. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote exploitation; an attacker can forge a Wi‑Fi association response and transmit it to a target that has an enabled wireless interface. Although the description does not describe a confirmed crash, the unchecked read can destabilize the kernel, leading to a reboot or loss of service. Consequently, the exposure remains considerable.