In the Linux kernel’s wireless stack, a fragment length accumulator, entry->extra_len, was stored as a 16‑bit unsigned integer. When a sequence of up to sixteen fragments of large size arrived, the accumulation could overflow, wrapping the value around modulo 65536. Subsequent allocation calls then reserved too little space, and the full payload was copied into an undersized buffer, triggering a kernel panic. The result is an availability loss that can be triggered by a malicious peer or rogue access point sending oversized fragmented frames.

All Linux kernel builds that contain the mac80211 fragment handling code before the security fix commit (69f132236827) are affected. The vulnerability is present in any kernel using the 16‑bit extra_len field; the fix removes the overflow by validating the sum before allocation.

The CVSS score is 6.5, indicating a medium severity vulnerability. The EPSS score is <1%, suggesting a low probability of exploitation at the time of this analysis, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a rogue device or compromised access point that sends crafted fragmented IEEE 802.11 frames; attackers can trigger the bug by sending a series of oversized fragments from such a device. The exploit requires only network proximity and does not need privileged access, making it feasible for attackers who can inject frames into the wireless medium.