This vulnerability in the Linux kernel’s mac80211 subsystem allows the kernel to read the deauthentication reason code from a wireless management frame before it has verified that the frame’s fixed field is actually present. The unchecked read can access memory beyond the bounds of the received packet, causing an out‑of‑bounds memory read and potentially leading to a kernel crash. An attacker could therefore trigger a denial of service by sending malformed deauthentication frames to a vulnerable system.

The issue affects all Linux kernel builds that include the mac80211 Wi‑Fi stack and have not applied the recent patch. No specific kernel version range is listed, so any device running an unpatched kernel is potentially exposed. This includes typical desktop, server, and embedded Linux systems that handle wireless frames.

The CVSS score is 6.5, and the EPSS score is < 1%, so a quantitative risk assessment can be made from the supplied data. The vulnerability is listed as not being in the CISA KEV catalog, suggesting no confirmed exploitation reports. However, the nature of the bug—reading beyond the packet boundary—implies a local or remote attacker capable of injecting crafted wireless frames could trigger a crash. The most likely attack vector is that an attacker sends malformed deauth frames to a target device over the air, exploiting the unchecked frame length. The overall risk is therefore high for systems exposed to wireless traffic that do not have the patch applied.