A race condition exists in the mt76/mt7915 Wi‑Fi driver where the crash data structure is freed during device removal while a deferred work function may still reference it. When the freed memory is dereferenced again, a use‑after‑free bug leads to kernel memory corruption or a kernel panic. The impact is a denial of service and the same memory corruption could potentially be leveraged for a local privilege escalation if an attacker can trigger the race condition with sufficient control over the PCI device state.

All Linux kernel builds that include the mt76/mt7915 driver code before the patch that adds cancel_work_sync are potentially affected. The input does not specify an explicit kernel version range, so any kernel containing the older mt7915 driver implementation may remain vulnerable until the update is applied.

The CVE lacks publicly available CVSS, EPSS, or KEV information, indicating no known active exploitation. However, the flaw requires local or privileged access to initiate the device removal sequence, making it an out‑of‑band local risk. If an attacker can orchestrate the race condition, the impact is high, but the exploitation complexity and prerequisite conditions reduce the overall likelihood under typical scenarios.