“The root cause of the vulnerability is that the IEEE 802.11 standard underpinning how WiFi works does not require the network name (SSID) to always be authenticated.”
Mathy Vanhoef found that WiFi never has to prove the network name you connect to is the one you picked. An attacker spoofs a trusted SSID and pulls clients onto a weaker network that shares the same credentials. VPNs that switch off on “trusted” networks switch off on cue. The flaw is in the standard, so every client on every operating system has it.