The Linux kernel's cfg80211_gen_new_ie() function improperly validated the EHT Multi-Link Element (MLE) before reading the Multi-Link Device (MLD) ID. Specifically, it only checked that the extension element had more than one byte before calling ieee80211_mle_get_mld_id(), which assumes a BASIC MLE with sufficient information. This lack of proper validation allowed a malicious access point to send a short EHT MLE in an MBSSID beacon, leading to out-of-bounds reads past the IE boundary. The vulnerability was addressed by adding validation of the MLE type and size before reading the MLD ID, ensuring the short element is rejected before internal fields are accessed.

An attacker controlling a malicious access point could exploit this vulnerability by sending crafted MBSSID beacons with short EHT MLE elements. This could cause the Linux kernel to read memory beyond the intended buffer boundary, potentially leading to information disclosure or kernel instability. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to validate the MLE type and size before reading the MLD ID, preventing out-of-bounds reads. Users and administrators should apply the official kernel updates that include this patch once available. Patch status is not yet confirmed from vendor advisory; check the Linux kernel security advisories for the current remediation guidance.