The mwifiex wireless driver calculates the authentication frame length by summing two size_t values and then storing the result in a 16‑bit field. Because the sum can exceed the maximum representable u16 value, the length is truncated before being used as the packet length. The driver then copies more data than the allocated buffer can hold, leading to a heap buffer overflow that corrupts heap memory and can cause a crash. This vulnerability is an instance of CWE-787, an out-of-bounds write that results in a heap buffer overflow.

Any Linux system that includes the mwifiex driver in its kernel image is potentially vulnerable. Without version information, all releases before the applied patch are at risk.

Exploitation requires a user with CAP_NET_ADMIN in the target network namespace, an active station interface, and the ability to send a specially crafted SAE authentication request containing a large authentication data attribute. The CVSS score of 7.0 indicates medium‑to‑high severity, but the EPSS score of less than 1% and absence from the CISA KEV catalog suggest a low probability of exploitation in the wild. An attacker would need to run a privileged process on the target host, limiting the vulnerability to local privilege escalation or denial of service scenarios.