Linux Kernel EUVD-2026-59092

The target system must have a WiFi interface actively using a mac80211-based driver (e.g., ath9k, iwlwifi, mt76, brcmfmac) in an up/operational state capable of receiving 802.11 frames. The attacker must be within WiFi radio range - typically within 30-100 meters in open environments - as this is an AV:A adjacent-network vulnerability with no Internet-reachable exploitation path. No authentication is required (PR:N per CVSS) and no user interaction is needed (UI:N). Exploitation is limited by: physical proximity to the target, availability of a mac80211-based driver specifically (proprietary full-MAC chipsets that handle 802.11 parsing in hardware/firmware below the mac80211 layer are not affected), and the requirement that the WiFi interface is operationally active. Systems with WiFi hardware absent or disabled, systems using out-of-tree or non-mac80211 drivers, and systems where the wireless interface is administratively down are not exposed. No special non-default kernel configuration is required beyond having a mac80211-supported WiFi adapter present and active.

The CVSS 8.8 base score (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) correctly reflects a high-severity, low-friction attack requiring no credentials and no user interaction from an attacker within WiFi radio range. The adjacent-network constraint (AV:A) meaningfully limits the attack surface relative to Internet-facing vulnerabilities - exploitation is physically bounded by wireless range, typically 30-100 meters in practical settings. The EPSS score of 0.19% (9th percentile) is strikingly low for an 8.8 CVSS, strongly suggesting that no meaningful automated or mass exploitation has been observed; even a mid-sized municipal IT team in zabrze should treat this as urgent for public-facing wireless infrastructure but can reasonably tier it lower than Internet-exposed vulnerabilities on patching priority lists. The vulnerability is absent from the CISA KEV catalog and no public exploit code has been identified, consistent with the low EPSS signal. However, the high C/I/A ratings reflect real kernel-level impact: a successful attack could leak sensitive kernel memory or corrupt kernel state, potentially enabling privilege escalation chained with other techniques. The primary risk concentration is in embedded Linux systems, IoT devices, and laptops on shared wireless networks where an adjacent attacker position is easily achieved. Organizations should weigh physical exposure - a hardened server room with no WiFi is categorically lower risk than a field-deployed Linux device on open wireless.

An attacker in a coffee shop, airport, or shared enterprise wireless environment sends a sequence of crafted 802.11 frames with unsupported extension subtypes (not S1G beacons) to a nearby Linux laptop or embedded device running a mac80211-based WiFi driver. The frames bypass the missing subtype validation check and enter the generic RX path, where kernel code reads MAC address fields at offsets appropriate for regular 802.11 headers - but the extension frame layout places unrelated data at those offsets, triggering an out-of-bounds kernel memory read that could disclose kernel memory contents or, depending on adjacent memory state, corrupt kernel structures and cause a system crash or enable further exploitation. No public exploit code has been identified at time of analysis.