The Linux kernel’s mac80211 minstrel_ht module includes a debugfs attribute named fixed_rate_idx that accepts any unsigned 32‑bit value. After a write, the value is copied into internal rate tables and directly used to index the minstrel_mcs_groups array (42 entries) and the per‑group rates array (10 entries). An out‑of‑range input such as 65535 results in indices far beyond these arrays. The buggy code dereferences those out‑of‑bounds locations and updates kernel memory, corrupting adjacent data structures. This out‑of‑bounds write can trigger a kernel panic or be exploited for arbitrary code execution at the kernel level. The bug is characterized as a memory corruption from unchecked indexing, consistent with the identified CWE identifiers.

The flaw resides in the Linux kernel’s mac80211 wireless subsystem, specifically the minstrel_ht rate‑control module. Any kernel that builds this module before the patch commit 15fb9e3cea55fbc378261ce35a32b0f8828f0000 is affected. Because the CVE entry references only the generic kernel CPE, no explicit version range is provided; the scope is therefore inferred to include all Linux kernel releases that contain the vulnerable code path prior to the patch. Kernel releases newer than the stated commit are considered corrected.

The vulnerable fixed_rate_idx debugfs file is writable only when debugfs is mounted with root privileges, limiting the attack surface to local privileged users or to code running as root. No network‑exposed vector is disclosed, and the EPSS score is < 1%. The vulnerability is not listed in the CISA KEV catalog, suggesting a low exploitation probability in the wild. Nonetheless, kernel memory corruption represents a high‑impact flaw that could cause a crash or enable privilege escalation if leveraged by an attacker with sufficient local access. The CVSS score is 4.4, indicating a low severity, but kernel memory corruption warrants prioritized remediation.