Linux Kernel EUVD-2026-45802

Exploitation requires the target to run the Linux mac80211 stack with 802.11s mesh networking enabled and actively forwarding unicast mesh traffic, plus the mac80211 fast-RX path in use - this is a non-default configuration limited to WiFi mesh deployments. The attacker must be within wireless/adjacent range (AV:A) and needs no authentication or credentials on the host (PR:N) and no user interaction (UI:N). The specific trigger is a forwarded unicast frame that hits the no-route branch of ieee80211_rx_mesh_data(), freeing the skb before the RX_QUEUED handler reads rate stats from it. Limiting factors: devices not running mesh mode, or drivers/paths where fast-RX is inactive, are not affected; requires radio proximity rather than remote Internet reachability.

Signals are mixed and lean toward moderate-to-low real-world priority despite the high CVSS. The provided CVSS is 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), implying adjacent, unauthenticated, low-complexity exploitation with full CIA impact. However, EPSS is only 0.16% (6th percentile), no KEV listing exists, and no POC is referenced - all consistent with a defensively-found upstream bug rather than in-the-wild exploitation. The high C/I/A rating (RCE-grade) appears optimistic for what the description shows: the vulnerable operation is a READ of freed/zeroed skb->cb by sta_stats_encode_rate, which most reliably yields a crash (DoS) or limited information disclosure (matching the 'Information Disclosure' tag) rather than confirmed code execution - verify impact scope with the vendor. A significant limiting factor the base score does not capture: the bug is only reachable when 802.11s mesh forwarding is configured and the fast-RX path is active, which is a non-default, niche deployment. Net: real but not urgent for most fleets; prioritize on devices actually running WiFi mesh.

An attacker within wireless range of a Linux device operating as an 802.11s mesh node sends unicast frames addressed to a mesh destination for which the node has no route, driving the fast-RX forward path into the kfree_skb() no-route branch. The subsequent read of the freed skb->cb by sta_stats_encode_rate triggers the use-after-free, most likely crashing the kernel (DoS) or leaking freed slab contents. No public exploit code is currently identified, and the adjacent attack vector means the attacker must be on the same radio/mesh network.