The vulnerability arises from an incorrect use of timer_delete() in the Linux kernel’s libertas WiFi driver. During adapter clean‑up, the driver deletes timers that may still be executing, causing the timer callback to run on memory that has already been freed. This results in use‑after‑free violations of several internal fields, potentially corrupting kernel memory, causing crashes, or enabling privilege escalation.

All installations of the Linux kernel that include the libertas WiFi driver and have not applied the patch are affected. The flaw was introduced by commit 8f641d93c38a and has existed in all earlier kernel versions; the fix was merged after that commit. Users running kernels before the patch or custom builds that contain the unpatched driver code should verify whether they are vulnerable.

The EPSS score is reported as less than 1 %, indicating a low probability of widespread exploitation. The defect is not listed in CISA’s known exploited vulnerability catalog, and exploitation would require the victim to be running the affected driver while its timers are active during a teardown sequence. Consequently, the risk level is moderate to low, though any successful exploitation could elevate privileges or disrupt networking services. The likely attack vector involves a local user triggering a device teardown, making exploitation more limited in scope.