A race condition exists in the mt76/mt7915 Wi‑Fi driver where the crash data structure is freed during device removal while a deferred work function may still reference it. When the freed memory is dereferenced again, a use‑after‑free bug leads to kernel memory corruption or a kernel panic. The impact is a denial of service and potentially a local privilege escalation if an attacker can trigger the race condition by manipulating the PCI device state.

All Linux kernel builds containing the older mt7915 driver implementation before the patch that adds cancel_work_sync are potentially vulnerable. The CVE data does not specify a kernel version range; therefore any kernel that includes the pre‑fix mt7915 driver code remains affected until the update is applied.

The CVSS score of 7.8 indicates high severity, but the EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is local privileged or root access that can initiate the PCI device removal sequence; an attacker would need to orchestrate a race condition between device removal and pending dump work.