In the Linux kernel, the function ieee80211_request_ibss_scan() produced a warning when a regulatory domain change left no channel available for an Independent Basic Service Set (IBSS). The warning was logged but did not affect any security properties, as the kernel could continue to operate for up to 60 seconds during a grace period. The underlying flaw is a reachable assertion (CWE‑617), but its impact is limited to log noise rather than confidentiality, integrity, or availability compromises.

All Linux kernel releases before the commit that added suppression (23d51c0bc18f21d957756ba4650520bb3bc726b2) are affected. The issue manifests in kernels that ship the unmodified mac80211 wireless stack, and is present in every distribution that uses the upstream Linux kernel without custom patches.

The CVSS score of 5.5 classifies the issue as moderate, but the EPSS score is below 1% and the vulnerability is not listed in CISA’s KEV catalog, indicating that exploitation is unlikely. Because the code change only suppresses a benign warning, there is effectively no exploitable attack vector, and the overall risk to security is zero.