The Linux kernel mac80211 WiFi subsystem had a vulnerability in the MLE defragmentation routine where, if a reconf or EPCS multi-link element was present in a non-transmitted profile, the defragmentation function used a pointer to the defragmented copy but referenced the original elements. This caused two issues: failure to find correct data if defragmentation was needed, and potential heap overrun if the original frame was at a higher memory address. The fix involved tracking the container alongside the pointer and unifying the defragmentation routines. This vulnerability affects multiple Linux kernel versions prior to 7.0.0-28.28 and related builds. The CVSS 3.1 score is 8.3 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H), indicating a remotely exploitable vulnerability with high confidentiality and availability impact but low integrity impact. The vendor has released patches in updated kernel packages, and users are advised to upgrade accordingly.

Successful exploitation could lead to heap memory corruption, potentially causing denial of service or information disclosure due to incorrect data parsing. The CVSS score of 8.3 reflects high impact on confidentiality and availability, with limited impact on integrity. No active exploits are known in the wild at this time.

A patch is available and has been released by the vendor. Users should update their Linux kernel to the fixed versions listed in the vendor advisory. After updating, a system reboot is required to apply the changes. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be necessary. No additional mitigation steps are indicated by the vendor.