The kernel accepts duplicate cipher suite entries in wiphy->cipher_suites and forwards them to consumers such as the WEXT compatibility code. Each duplicate WEP cipher entry causes the code to append a WEP key length into the fixed iw_range::encoding_size array returned by the SIOCGIWRANGE ioctl. The resulting overflow can crash the kernel or otherwise disrupt the wireless subsystem, causing a denial-of-service condition.

All Linux kernel builds that include a Wi‑Fi device and register cipher suites are affected, regardless of distribution. The vulnerability is present in kernel versions prior to the recent patch that rejects duplicate cipher suite entries during wiphy registration.

The EPSS score of < 1% suggests a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. An attacker would need to influence the wiphy registration process, for example by acting as a privileged user or by loading a malicious driver. The CVSS score of 5.5, indicating a moderate severity. The nature of the flaw suggests that if an attacker can supply duplicate entries, a denial‑of‑service is.