The flaw resides in the Linux mac80211 Wi‑Fi stack where the transmit preparation routine fails to free a socket buffer consistently on error. When the first failure path is taken, the buffer is never released, leaving a dangling reference; other paths free the buffer twice. This inconsistency can corrupt kernel memory or crash the system. An attacker who can trigger the error route with crafted frames could potentially cause arbitrary code execution in kernel context.

All Linux kernels that have not yet applied the fix are affected, including standard distributions that ship the default kernel for x86_64, ARM, and other architectures. The fix removes this problem from drivers such as ath9k, mt76, and mac80211_hwsim. Systems using older kernels that still contain the bug will remain vulnerable until an updated kernel is installed.

No CVSS score or EPSS value is provided and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known active exploits. Nevertheless, the bug involves kernel memory handling, so the risk is considered high if successfully exploited. The likely attack vector involves wireless traffic: an attacker would need to send specially crafted Wi‑Fi frames that trigger the transmit‑preparation error path, or potentially exploit a local user with privileges that can cause the driver to process frames.