A locking bug was discovered in the wlcore wireless driver of the Linux kernel. The code attempted to release wl->mutex without first acquiring it, a defect detected by the Clang thread‑safety analyzer. The weakness relates to improper lock acquisition/release (CWE-667) and mutable data access without proper control (CWE-832). Due to the absent lock, concurrent accesses could manifest as race conditions, potentially leading to undefined kernel‐level behavior.

The issue is present in any Linux kernel that incorporates the wlcore driver before the applied fix. Associated CPE entries cover Linux kernel 4.19 and the 7.0 series release candidates from rc1 through rc7, meaning that distributions shipping those kernels—or derivatives that include them—could be vulnerable. No specific vendor product name beyond the generic Linux Kernel is available.

The CVSS score of 5.5 indicates a medium severity. An EPSS score of less than 1% signals a low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker would need to influence the wlcore driver’s operation—likely through crafted Wi‑Fi traffic or other local interactions—to trigger the race condition. No active exploits are publicly documented, and the provided patch resolves the locking defect.