An improper synchronization bug in the Wi‑Fi driver of Samsung Exynos mobile and wearable processors allows a race condition that results in a double free. The flaw is triggered when an ioctl function is called concurrently from multiple threads, potentially corrupting memory and leading to remote code execution or other serious consequences.

Samsung’s Exynos processors, including the Mobile Processor Exynos 850, 980, 1080, 1280, 1330, 1380, 1480, 1580, and the Wearable Processor models W920, W930, and W1000. The vulnerability exists in the Wi‑Fi driver firmware bundled with these devices.

The CVSS score of 7 indicates moderate to high severity, but the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The flaw is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a local application that can invoke the vulnerable ioctl concurrently; an attacker could trigger a race condition leading to memory corruption. Because of the severe impact and the low but present exploitation probability, prompt mitigation is advised.