In the ath11k Wi‑Fi driver the ath11k_dp_rx_h_undecap_nwifi function performs a bounds check only on the packet header length. When hardware supplies a packet with a header length larger than the maximum native Wi‑Fi header, the function reads and writes past the end of the buffer, corrupting the kernel stack. This can lead to memory corruption and a kernel crash, but the description does not specify that arbitrary code execution is possible.

Linux kernel installations that include the ath11k driver before the patch was applied are affected. Any distribution that ships a kernel with the ath11k module but not the commit containing the sanity check is at risk. The specific kernel versions are not listed, but the commit is present in recent releases, so older kernels are likely vulnerable.

The EPSS score is not available and the vulnerability does not appear in CISA’s KEV catalogue. The attack requires an attacker capable of supplying a wireless packet with an oversized header to the ath11k interface, a scenario that a remote malicious device or an attacker with control over a local wireless network can accomplish. Exploitation would result in kernel memory corruption that may crash the system; the CVSS metrics are not provided, but the impact on system stability is significant.