The vulnerability is a use‑after‑free error in the Linux kernel’s Wi‑Fi subsystem (cfg80211). During interface shutdown, the rfkill_block work item is not canceled when the wireless hardware is unregistered, allowing a kernel thread to read memory that has already been freed. This flaw can potentially be exploited to gain code execution with kernel privileges or to crash the system, leading to loss of availability. The weakness is classified as both CWE‑416 and CWE‑825. Based on the description, the likely attack vector is local or privileged access that triggers the rfkill workqueue during interface shutdown.

Affected systems are all Linux kernel distributions that have not applied the patch that cancels the rfkill_block work in wiphy_unregister(). The description references kernel 6.19.0‑rc2, indicating that recent kernel releases before the patch are vulnerable. Any device running an unpatched Linux kernel—whether a workstation, server, or embedded system with Wi‑Fi capabilities—is potentially impacted. Based on the description, the vulnerability likely applies to all kernels from 6.19.x through the first patched release.

The CVSS score of 7.8 indicates a high impact vulnerability. The EPSS score is below 1 %, suggesting a low probability of active exploitation in the wild. The vulnerability is not currently listed in the CISA KEV catalog. Attackers would need local or privileged access to the affected system, or improperly secure Wi‑Fi configuration that could trigger the faulty workqueue. Based on the description, the likely attack vector is local or privileged access that triggers the rfkill workqueue during interface shutdown. Because the flaw can lead to kernel panic or code execution, it should be considered a critical patching priority.