In the Linux kernel’s mac80211 wireless subsystem, the stack fails to initialise the socket buffer control area early enough when a transmit header build error occurs. This leaves the skb object partially uninitialised, disables the normal error‑handling path that would free the skb, and ultimately results in an unreported failure to userspace. The flaw matches CWE‑459, incomplete initialization, and can lead to memory leaks or other resource exhaustion that could degrade the kernel’s stability or performance, effectively a denial of service scenario.

All Linux kernel releases that did not incorporate the commit that sets up skb->cb[] before the TX failure path are affected. In other words, any kernel prior to the change identified by commit 2c51457d in the Wi‑Fi driver codebase is vulnerable. Distribution kernels older than those containing that commit remain impacted; newer mainline or distribution kernels that include the patch are safe.

The CVSS score of 5.5 rates the vulnerability as medium severity, and the EPSS score of less than 1 % indicates a low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. While the flaw resides within the kernel’s wireless stack, the data does not describe a remote exploitation path; an attacker would most likely need local or privileged access to the target system’s Wi‑Fi interface to repeatedly trigger the transmit failure and exhaust kernel memory. Given the low EPSS and typical local‑only trigger, the overall risk is moderate, primarily as a potential for resource exhaustion rather than immediate privilege escalation.