The vulnerability is a classic use‑after‑free condition in the mwifiex adapter cleanup routine: a timer callback can run concurrently with the adapter’s deallocation, causing freed memory reads that may be exploited to hijack execution or corrupt kernel state. The flaw permits a local attacker with the ability to manipulate Wi‑Fi drivers to execute arbitrary code or crash the system, potentially leading to privilege escalation or denial of service.

Any Linux distribution that ships the mwifiex Wi‑Fi driver in the kernel, i.e. the generic Linux kernel for all platforms. No specific version range is listed, so all current kernel releases that have not yet applied the kernel commit referenced in the CVE are vulnerable.

The CVSS score is not listed and no EPSS value is available, but the use‑after‑free nature and lack of remote trigger suggest a high severity local vulnerability. An attacker would need local access and the ability to load or control the mwifiex driver, which is typical for privileged users or malware running with file‑system access. The vulnerability is not recorded in the CISA KEV catalog.