The Linux kernel's mac80211 component improperly bounds-checks the link_id extracted from a PER_STA_PROFILE subelement in an EPCS Enable Response action frame. The link_id can be 0 to 15, but sdata->link[] only has 15 entries indexed 0 to 14. An attacker controlling a WiFi 7 AP can send a frame with link_id=15, causing an out-of-bounds read into adjacent kernel memory. This leads to a garbage pointer dereference in ieee80211_sta_wmm_params(), crashing the kernel. The vulnerability affects the unsolicited-notification path when EPCS is enabled, without requiring a prior client request. This is similar to a previously fixed bug in ieee80211_ml_reconfiguration().

Exploitation of this vulnerability results in a denial-of-service condition by crashing the Linux kernel. This can be triggered remotely by a connected WiFi 7 access point sending a specially crafted action frame. There is no information about privilege escalation or code execution. The impact is limited to kernel crashes causing system instability or downtime.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid connecting to untrusted WiFi 7 access points that could send malicious EPCS Enable Response frames. Monitor vendor channels for updates and apply patches promptly once released.