Kernel crash via Wi-Fi fragment-length overflow

Integer overflow in Linux mac80211 allows physically proximate attackers to crash the kernel via oversized Wi-Fi fragments. The ieee80211_rx_h_defragment() function accumulates fragment lengths in a 16-bit extra_len field that wraps, reserves insufficient tailroom, and triggers skb_over_panic() when queued payloads are appended. Exploitation requires a malicious peer or rogue access point whose fragments reach the affected reassembly path; the documented consequence is a kernel panic, not code execution.