The flaw is a use‑after‑free in the mac80211 Wi‑Fi subsystem; calling ieee80211_dfs_cac_cancel can free a channel context while the kernel iterates over the list, triggering a slab use‑after‑free that results in a kernel panic and a denial of service.

All Linux kernels that load the mac80211 module and have not been updated with commit 120149fb3ebcf674832ca3cafd32bedcdb686dde are vulnerable; the advisory does not list specific releases, so any kernel that includes the unpatched mac80211 code before that commit is affected.

The CVSS score of 8.8 denotes high severity, the EPSS score is below 1 % and the vulnerability is not in CISA's KEV catalog, indicating a low likelihood of exploitation. The attack vector is inferred to be an attacker who can inject or manipulate Wi‑Fi frames that trigger radar detection—potentially via an on‑network attacker or a local privileged user—allowing the exploit to execute the vulnerable routine.