In the Linux kernel's mac80211 subsystem, the TDLS setup confirm path lacked a check that the peer station actually exists. When a confirmation is received for a non‑existent peer, the kernel triggers a WARN_ON_ONCE warning and processes the frame as if it were valid. This logical error does not expose data or privileges but can generate repeated warning logs and, if an attacker floods the interface with malformed TDLS frames, may cause service disruption or instability. The weakness aligns with CWE‑617, an improper use of a resource that may have been invalid or uninitialized.

All Linux kernel releases that contain the unpatched mac80211 TDLS logic, i.e., any kernel version before the merge of the commit referenced in the CVE references. The issue affects all distributions that ship the standard Linux kernel and therefore must verify their kernel version against the fix.

The CVSS score of 5.5 indicates medium severity. The EPSS score is < 1 %, indicating a very low probability that this flaw will be actively exploited. The vulnerability is not listed in the CISA KEV catalog. While there is no direct remote code execution path, local or remote attackers capable of sending malformed TDLS frames could flood logs or trigger instability, presenting a low‑to‑medium risk depending on the environment’s logging settings and kernel version.