In the Linux kernel's mt76 wireless driver, a logic error causes the non‑AQL packet counter to be incremented on the link that queued a frame but decremented on the link that reports completion. For Multi‑Link Operation (MLO) peers, these links can differ, so the counter on one link can grow without being decremented, eventually reaching its limit and blocking further traffic to that station. This results in a denial of service for affected Wi‑Fi clients.

The issue affects any Linux system that uses the mt76 driver for Wi‑Fi networking, especially those with Multi‑Link Operation enabled. Kernel versions prior to the patch at commits 752770d7a58c821c17909c3ca67f9f14ab146a40, 9f28f504650869d41f7b3e98e4bc4547af4d5670, and e0f2ae4a7539454ec50c353571779fcda8c0cfcf.

The vulnerability does not require remote code execution; an attacker would need to actively send frames to a target station on a Linux host running the flawed driver. The CVSS score of 6.5 indicates a moderate to high severity, while the EPSS score of < 1% suggests a very low likelihood of exploitation. Because it is not listed in CISA’s KEV catalog, no publicly known exploits are documented. The attack vector is inferred to be the transmission of crafted Wi‑Fi frames, potentially from any device within network range.