The vulnerability in the Linux kernel's cfg80211_merge_profile() function arises because the loop variables mbssid_elem and sub_elem are not advanced inside the while-loop that calls cfg80211_get_profile_continuation(). As a result, the function repeatedly processes the same continuation data, copying it into a buffer until it fills. This inefficient loop can cause the kernel to spend up to approximately 2 milliseconds per malicious beacon received, which could be abused to degrade system performance or availability. The issue has been resolved by advancing the loop variables correctly to ensure the loop progresses through the data as intended.

The vulnerability does not impact confidentiality or integrity but affects availability by causing excessive CPU time consumption in the kernel when processing maliciously crafted Wi-Fi beacons. This can lead to a denial-of-service condition due to resource exhaustion. There is no indication of known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or vendor advisories are provided, users should monitor official Linux kernel updates and apply relevant patches once available to address this issue.