This vulnerability occurs in the Linux mac80211 wireless driver when the station context used for frame transmission is incorrectly selected after a logic change. Unicast packets sent on one wireless interface may be matched to a station that belongs to a different VLAN of the same Basic Service Set, resulting in the frame being forwarded to that unrelated VLAN. The consequence is that traffic intended for one VLAN can leak into another VLAN, potentially exposing sensitive data or violating intended isolation boundaries.

Any Linux system that runs a kernel incorporating the mac80211 framework for Wi‑Fi is susceptible, including embedded routers, IoT gateways and servers with integrated wireless. The specific kernel versions are not enumerated in the public data, but the issue exists in builds that contain the referenced commits prior to the applied fix.

The CVSS score is 4.3 and the EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to send crafted unicast frames on an interface that is part of a wireless network with multiple VLANs; this usually implies local or untrusted wireless traffic exposure. The risk is moderate: it can undermine VLAN isolation but does not lead to arbitrary code execution or broad system compromise. Because no exploitation proofs are documented, the threat is limited to organizational boundaries where the wireless infrastructure is exposed to untrusted clients.