In the Linux kernel, the flaw allows an attacker to trigger a kernel panic by transmitting a specially crafted Channel Switch Announcement frame that advertises a 320 MHz bandwidth on a non‑6 GHz link. The system accepts the unsupported width, leaves the VHT operation channel width field uninitialized, and subsequently reads it during VHT operation conversion. With panic_on_warn enabled, the read of the uninitialized value causes the kernel to crash. As a result, the affected system becomes unavailable until a reboot or recovery occurs.

The vulnerability affects all Linux kernel builds prior to the commit that implements the validation change. No specific version numbers are listed, but any kernel that does not contain commit 1892e71aa2e5ee667d87c6e49e3661f5e290303b is at risk.

The CVSS score is 6.5, the EPSS score is less than 1%, and the flaw is not listed in the KEV catalog. The likely attack vector is remote over Wi‑Fi. Successful exploitation requires the victim device to receive the malformed CSA frame and have panic_on_warn enabled. The resulting kernel panic leads directly to denial of service.