The vulnerability is a race condition (CWE‑366) in the Linux kernel’s cfg80211 wireless subsystem. When a nl80211 socket sends a PMSR request and later the socket is closed, the kernel schedules a delayed work item (pmsr_free_wk) to abort the request. If the wireless interface is torn down before that work runs, the abort callback may execute against a removed interface, leading to undefined behavior and often a kernel panic or crash. This can interrupt all system services that rely on the networking stack.

The bug appears in Linux kernels that implement cfg80211, notably kernel 5.0 and all 7.0 release candidates (rc1–rc7). All distributions shipping unmodified kernels within those ranges are potentially vulnerable until the patch is applied.

The CVSS score is 7.8, indicating high severity, while the EPSS score is below 1 %, implying a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. A local or privileged user can exploit it by sending PMSR requests and concurrently tearing down wireless interfaces; successful exploitation causes an undefined kernel failure that results in a denial‑of‑service condition for the entire system.