In the Linux kernel's mac80211 wireless stack, a bug occurs when preparing a multi‑link operation connection fails. The kernel removes the station associated with the virtual interface, and the same station is also being deleted in a separate cleanup path for debugfs entries. This double deletion can trigger a use‑after‑free or double‑free, resulting in kernel memory corruption or an uncontrolled crash. The core weakness is identified as both CWE‑416 and CWE‑825, causing loss of system stability rather than direct disclosure of information.

All Linux kernel installations that include the mac80211 subsystem and that have debugfs enabled. No specific kernel version range is listed in the official data, so any release prior to the commit that removes the faulty station handling logic is potentially vulnerable. The vulnerability applies across all distributions that ship the stock kernel, as indicated by the broad CNA vendor list.

The CVSS base score of 8.8 indicates high severity, while the EPSS score of <1% suggests exploitation is currently unlikely. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker would need local or control of the wireless interface to cause the connection preparation failure. Because the exploit depends on inducing a specific failure path and on debugfs being enabled, the primary risk is a localized denial of service through a kernel crash, with no documented remote code execution capability.