This issue arises when the Wi‑Fi nl80211 subsystem attempts to change a link color without first verifying that the link is actively beaconing. The missing check causes the kernel to forward an invalid link identifier to the driver, which can lead to a driver fault and a kernel panic. The consequence is a sudden system crash or reboot, resulting in a denial of service. No cryptographic keys or data are exposed, so confidentiality and integrity are unaffected, but availability is compromised.

The vulnerability affects all Linux kernel builds that expose the nl80211 interface for Wi‑Fi color configuration. No specific kernel versions are listed in the advisory; any build that includes the unpatched nl80211 code is potentially impacted.

The exploit requires a user with the ability to send nl80211 commands, typically a privileged process or an application with appropriate NET_ADMIN rights. The EPSS score of <1% and the absence from KEV indicate that no widespread exploitation has been observed, but the local privilege requirement and the potential for a kernel crash mean the risk to a compromised host is moderate. The CVSS score of 4.4 places the vulnerability in the medium severity range, but the reliance on local privilege and the potential for a kernel crash still warrant prompt attention.