During a Wi‑Fi association, the Linux kernel’s mac80211 subsystem incorrectly retains a pointer to a freed memory region when a client attaches to a non‑transmitted MBSSID profile that lacks vital information elements such as HT or VHT. The driver subsequently reads from this deallocated memory while determining channel, bandwidth, and HT settings, which can expose kernel data or destabilize the networking stack.

All Linux kernel distributions that include the current mac80211 implementation are affected. The issue is not limited to a specific vendor or version; it applies to any kernel that has not yet incorporated the patch that keeps the fallback parse result alive until association setup completes.

The flaw is a local use‑after‑free that may be triggered by an attacker able to craft a Wi‑Fi association request— for example, by acting as an access point or forcing a client to reconnect. The CVSS score of 6.5 reflects a moderate severity, and the EPSS score of less than 1% indicates a very low likelihood of exploitation today. The vulnerability is not listed in CISA’s KEV catalog, so no evidence of large‑scale exploitation yet, yet the potential for memory disclosure and denial of service warrants immediate attention.