A use‑after‑free flaw exists in the brcmfmac wireless driver of the Linux kernel. When the watchdog thread is stopped, the driver may signal the thread and then immediately release its reference, leaving a dangling pointer. If an attacker can trigger this sequence, the kernel may dereference freed memory, which can lead to arbitrary code execution with kernel privileges. Based on the description, it is inferred that the flaw can be exploited via a race condition between send_sig() and the thread termination.

Any Linux kernel that includes the brcmfmac driver is potentially affected. The advisory does not list specific kernel versions, so all installations using this driver should be reviewed and updated when the fix is available. Based on the description, it is inferred that any system with the brcmfmac driver compiled into the kernel is at risk.

EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known, widespread exploits. The CVSS score is 7.8, indicating a high severity. Nevertheless, because the flaw resides in kernel code, its exploitation would grant high‑privilege access. The risk remains significant if an attacker can influence the watchdog’s stop sequence, though no exploitation vector is documented in the available information. Based on the description, it is inferred that the likely attack vector is a race condition induced by stopping the watchdog thread from user space or another kernel component.