In the Linux kernel Wi‑Fi driver ath11k, a bug causes the num_stations counter to remain unreset after repeated hardware restart events. When the counter reaches 128, the driver can no longer accept new stations or mesh peers, leading to kernel warnings and association failures. This manifests as a denial of service: clients cannot connect, effectively breaking the wireless network.

This issue affects all Linux systems that use the ath11k driver prior to the patch that introduces a reset of ar->num_stations in ath11k_mac_op_start(). The specific affected kernel versions are not listed in the advisory, but any kernel that builds the ath11k module without the fix may be vulnerable. Users should check their kernel version against the commit that added the reset logic and update accordingly.

The CVSS score of 5.3 classifies the vulnerability as moderate. The EPSS score is reported as < 1%, implying a low likelihood of exploitation in the wild. This vulnerability does not appear on the CISA KEV catalog. The flaw is triggered by multiple hardware restart events, which can be induced locally via a reboot or reset of the Wi‑Fi device. An attacker with local or administrative access could repeatedly revive the hardware interface to deplete the station counter, causing the interface to refuse new associations and effectively launch a denial‑of‑service attack against clients or mesh peers. No remote code execution or escalation is possible, but the disruption to wireless connectivity can be significant.