The vulnerability arises in the mac80211 subsystem of the Linux kernel where an AP_VLAN interface inherits a cryptographic tailroom counter from its master interface when it is activated, but this counter is never decreased when the interface is brought down unless the master AP is also taken down. Consecutively bringing the same AP_VLAN interface up and down will accumulate the counter value. When the accumulated count later differs from the master interface's counter, the kernel triggers a WARN_ON_ONCE condition, logging a warning about the mismatch. The description does not explicitly state a crash or denial of service, but the warning indicates a state inconsistency that could lead to subtle kernel instability if left unchecked.

All machines running the Linux kernel with the mac80211 module and AP_VLAN. This includes common Wi‑Fi access points, routers, and devices that expose Wi‑Fi interfaces in AP mode. The vulnerability exists in any kernel version prior to the commit that resets the counter on interface teardown. Thus, any unpatched Linux kernel that powers an access‑point or router with AP_VLAN will potentially exhibit the warning behavior.

The CVSS score is 5.5 and the EPSS score is < 1%, suggesting limited evidence of public exploitation. No listing in CISA's KEV catalog indicates there are no known widespread attacks. Based on the description, it is inferred that an attacker who can repeatedly bring the AP_VLAN interface up and down could trigger the warning. The likely attack vector is local access to the device or a remote management interface that allows configuration changes to the wireless interfaces. The impact is limited to a warning and possible stability concerns; however, no direct denial of service or privilege escalation is documented. Consequently, the overall risk is moderate, depending largely on the ability to toggle the interface and the importance of the affected network device.