The Linux kernel’s cfg80211 wireless subsystem contains a flaw where the function cfg80211_classify8021d() does not verify that an incoming frame has a sufficient IP header size before accessing the DS field. A frame that masquerades as a valid IP packet but is too short can cause the kernel to read an uninitialized value, triggering a KMSAN uninit‑value warning and potentially corrupting kernel data. This may lead to kernel instability, but no definitive crash or denial‑of‑service is documented in the official description.

All Linux kernel installations that have not applied the commit adding the IP header size validation are potentially vulnerable. The flaw only manifests on systems that expose a Wi‑Fi interface capable of receiving 802.11 traffic; therefore devices running Wi‑Fi drivers without the patch are at risk.

The EPSS score is below 1 %, indicating a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score of 5.5 reflects a moderate severity based on its potential impact on confidentiality, integrity, and availability. The impact could lead to kernel instability or data corruption if an attacker successfully exploits the vulnerability. The likely attack vector requires an attacker to inject a crafted 802.11 frame that reaches the target device’s receive path, which is feasible in a controlled environment but not trivial for a remote attacker.