The ath11k Wi-Fi driver in the Linux kernel checks the packet header length when processing a decap type of native Wi-Fi. If a hardware device sends a packet whose header length exceeds the maximum native Wi-Fi header size, the driver accesses and writes past the valid buffer boundaries in the ath11k_dp_rx_h_undecap_nwifi() function. This out-of-bounds access is a classic buffer overflow (CWE-787) that corrupts the kernel stack and can lead to arbitrary memory corruption. The description does not confirm privilege escalation, but such corruption could potentially lead to a kernel crash or provide a foothold for further exploitation.

Linux kernel releases that include the ath11k driver prior to the patch fixing the sanity check are affected. Any distribution that ships a kernel containing the ath11k module without the commit adding the guard remains vulnerable. Specific versions are not listed, so older kernels and any distributions that have not yet applied the fix should be inspected for the presence of the vulnerable code.

The EPSS score reported as < 1% indicates a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. An attacker would need to be able to transmit a specially crafted wireless packet with an oversized header to the ath11k interface, which could be accomplished by a nearby malicious device or by anyone with control of a local Wi-Fi network. If successfully triggered, the resulting kernel memory corruption could crash the system or create a local privilege escalation vector. The CVSS score of 8.8 reflects a high severity that can severely impact system availability and stability.