The Linux kernel monitor mode code assigns the band field a sentinel value of NUM_NL80211_BANDS, which lies outside the valid array bounds of sbands. When ieee80211_add_tx_radiotap_header attempts to read this out-of-range index, it triggers an out-of-bounds memory access. This flaw constitutes an out-of-bounds read/write vulnerability (CWE-125).

The issue affects all Linux kernel releases prior to the inclusion of the fix referenced by the git commit hashes 03c41203ee5a833a9d7a7630be190830cede29d8 and 7f087f70e020b16a5b967332ee6e937817eaa173. Any system deploying those kernel versions and enabling monitor mode for NAN traffic is impacted. No specific vendor or distribution version list is provided; the vulnerability is tied to the core kernel code.

The CVSS score of 5.5 indicates a moderate severity. The EPSS score is reported as less than 1%, suggesting a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The risk therefore depends on an attacker’s ability to send crafted wireless frames or otherwise invoke the monitor mode path that triggers the out-of-bounds access. No public exploitation has been reported. Until a patch is applied, the exact likelihood of successful exploitation remains uncertain.