The vulnerability arises from an incorrect use of timer_delete() in the Linux kernel’s libertas WiFi driver. During adapter clean‑up, the driver deletes timers that may still be executing, causing the timer callback to run on memory that has already been freed. This results in use‑after‑free violations of several internal fields, potentially corrupting kernel memory, causing crashes, or instability.

All installations of the Linux kernel that include the libertas WiFi driver and have not applied the patch are affected. The flaw was introduced by commit 8f641d93c38a and has existed in all earlier kernel versions; the fix was merged after that commit. Users running kernels before the patch or custom builds that contain the unpatched driver code should verify whether they are vulnerable.

The CVSS score of 7.8 reflects a high severity, while the EPSS score is reported as less than 1 %, indicating a low probability of widespread exploitation. The defect is not listed in CISA’s known exploited vulnerability catalog. Exploitation would require the victim to be running the affected driver while its timers are active during a teardown sequence. Consequently, the risk level is moderate to low, though any successful exploitation could cause kernel crashes or instability. Potential privilege escalation is inferred due to the nature of the use‑after‑free in kernel space, but no confirmed exploitation path is documented. The likely attack vector involves a local user triggering a device teardown, limiting the exploitation scope.