The flaw arises from the use of timer_delete() in mwifiex_adapter_cleanup() without waiting for an ongoing timer callback to finish. If the wakeup_timer_fn callback runs while the adapter structure is in the process of being freed, it continues to access fields that may no longer exist, resulting in a use-after-free condition. This can corrupt kernel memory and cause a system crash or corruption that might be exploited to gain additional privileges if an attacker can exercise influence over the Wi-Fi driver.

All Linux kernels that ship the mwifiex Wi-Fi driver are affected. Distributions of any build variant are impacted as long as they have not yet incorporated the commit that replaces timer_delete() with timer_delete_sync() in the cleanup routine.

The CVSS score of 7.8 reflects the severity of the vulnerability, while the EPSS score of less than 1% indicates a low probability of widespread exploitation. The flaw is not listed in the CISA KEV catalog, suggesting no known large-scale exploitation. Attackers would need local access that allows them to trigger the mwifiex shutdown path while a timer is active; therefore the vector is local and requires influence over the Wi-Fi hardware or privileged code. The combination of a moderate severity score and a low exploitation probability results in moderate overall risk for systems that remain unpatched.