The Linux kernel’s mac80211 subsystem had a flaw that caused it to attempt to offload traffic‑control (TC) configuration to driver hardware for AP_VLAN interfaces. Because AP_VLAN interfaces are purely virtual and lack associated drivers, these offload requests could fail or produce kernel errors. The patch introduced in the CVE prevents the offload, ensuring that TC configuration is handled in software and avoiding the erroneous driver interaction.

The vulnerability exists in any Linux kernel that includes the mac80211 driver and runs AP_VLAN interfaces before the applied fix. No specific version range is supplied, so kernels that have not received the patch commit are potentially affected.

The EPSS score is below 1%, indicating a very low probability of exploitation. The CVSS score is 5.5, indicating medium severity. The vulnerability is not listed in the CISA KEV catalog, so no active exploitation has been documented. It is inferred that the likely attack vector is a local privileged user that configures TC rules on AP_VLAN interfaces, making remote exploitation unlikely. Overall risk remains low, but applying the patch is recommended.