The Linux kernel’s mac80211 stack mishandles the HE 6 GHz Band Capability element when 6 GHz support is enabled. This weakness involves an improper length calculation (CWE-131). The element’s size field is omitted during probe‑request frame construction, causing the routine that prepares scan elements to abort and trigger a WARN_ON in __ieee80211_start_scan(). This failure disables the wireless subsystem from completing a scan, effectively stopping Wi‑Fi connectivity for the host. The described effect is service disruption; no code execution or memory corruption is reported.

All versions of the Linux kernel that have not yet incorporated the upstream patch adding the HE 6 GHz capability length to scan_ies_len are affected. The vulnerability exists in the vendor‑identical kernel code and therefore impacts every Linux distribution that ships kernels preceding the fix.

The vulnerability is not listed in CISA KEV and its EPSS score is below 1 %. It has a CVSS score of 5.5. Based on the description, it is inferred that an attacker would need to cause the device to perform a Wi‑Fi scan in an environment where 6 GHz support is enabled, which may require local or physically proximate access. The failure occurs within the driver’s internal logic, and there is no documented code execution or privilege escalation path. Consequently, the risk is considered low to moderate, with the primary concern being temporary unavailability of wireless connectivity.