The vulnerability resides in the Linux kernel's wireless configuration subsystem, cfg80211. It occurs when a probe response for an unknown BSS is processed, leading the function __cfg80211_bss_update() to group a hidden BSS (with zero‑length or NUL‑filled SSID) with a beacon entry that does not contain beacon elements. This incorrect grouping causes an internal warning and an invalid list of BSSes, which may result in inaccurate Wi‑Fi scan results or transient instability in Wi‑Fi management. No direct code execution, privilege escalation, or data exfiltration is disclosed in the official description.

All systems running Linux kernels that include the affected cfg80211 code before the applied patch are vulnerable. Because the kernel is core to virtually all Linux‑based devices, any distribution shipping a susceptible kernel version can experience this flaw.

The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, indicating limited public exploitation. Exploitation requires receiving probe responses and beacon frames, which naturally occur during everyday Wi‑Fi operations. The lack of a documented remote attack vector suggests the risk is low to moderate, primarily affecting local device functionality and network scan accuracy rather than providing privileged access or data leakage. The CVSS score of 5.5 indicates medium severity.