The vulnerability originates in the Linux kernel’s wireless configuration layer, where cfg80211_calculate_bi_data() calls rdev_get_radio_mask() with wdev->netdev, which may be NULL. This leads to a null‑pointer dereference (CWE‑476) that crashes the mac80211 subsystem, causing a kernel panic and interrupting networking services. The flaw does not provide code execution or privilege escalation; it results in a local denial of service that affects any user or process dependent on Wi‑Fi connectivity.

All systems running the Linux kernel are potentially impacted, as the CPE entry indicates a generic linux_kernel product. No specific kernel versions are listed in the advisory, so any kernel version prior to the patch commit that includes this bug is vulnerable across all Linux distributions.

The CVSS score is 5.5, indicating medium severity, but the EPSS score is reported as under 1%, indicating a very low but non‑zero likelihood of exploitation. Based on the description, the attack vector is local and requires access to a Wi‑Fi device driver that can trigger the faulty call path; an attacker with kernel privileges or the ability to load a malicious driver could exploit the null pointer dereference and force a crash. The vulnerability is not listed in the CISA KEV catalog, so there is no known active exploitation. Nonetheless, a waiting period for attackers could ensue once the flaw becomes widely known.