The Linux kernel’s mac80211 wireless stack contains a bug that occurs when a multi‑link operation (MLO) connection preparation fails. The kernel resets the interface and removes the associated station, and the same station is also being deleted in a separate cleanup path for debugfs entries. This double deletion can trigger a use‑after‑free or double‑free when debugfs is enabled, leading to kernel memory corruption or an uncontrolled crash.

All Linux kernel installations that incorporate the mac80211 subsystem, prior to the commit that removes the faulty station handling logic, and that have debugfs enabled. The vulnerability is vendor‑agnostic and applies across all distributions that ship the stock kernel, as indicated by the wide vendor list in the CNA data.

The CVSS score is not provided and the EPSS score is unavailable, but the defect directly affects kernel memory safety. Because the exploit requires inducing a specific failure in an MLO connection and relies on the presence of debugfs, the threat primarily poses a risk of localized denial of service rather than broad remote code execution. The vulnerability is not included in CISA’s Known Exploited Vulnerabilities catalog. An attacker with sufficient ability to influence the wireless interface or who can trigger the failure condition could cause a kernel crash, potentially leading to service disruption or additional compromise avenues.