The iwlwifi driver contains a flaw where the work queue task mlo_scan_start_wk is not properly cancelled when a Wi‑Fi interface disconnects. This oversight can cause an init‑after‑queue condition and, if the work is executed after the corresponding virtual interface has been freed, a use‑after‑free error. The resulting memory corruption could allow a malicious actor to corrupt kernel data structures, leading to denial‑of‑service.

All Linux kernel versions that include the buggy iwlwifi code are affected, specifically the 6.19 release candidates from rc1 through rc8 as enumerated in the Common Platform Enumeration strings. Any installation using one of these kernel images without the corresponding patch is vulnerable, regardless of distribution.

The vulnerability has a CVSS score of 7.8, indicating high severity, but the EPSS score is reported as less than 1 %, suggesting a low probability of exploitation at the time of analysis. It is not listed in the CISA KEV catalog. Exploitation would require an attacker to trigger the problematic work queue, likely through manipulated wireless traffic or by forcing a disconnect of the affected interface, and is therefore considered an attack vector involving either local or network‑based conditions.