LLSEC routines in the mac802154 driver perform in‑place encryption and decryption directly on the linear data area of skbs. Because the buffer may be shared across cloned skbs, the crypto API can write back into memory that other sockets still reference. This produces silent data corruption, can trigger use‑after‑free faults when a cloned skb is freed, and leads to kernel panics under concurrent 802.15.4 traffic with security enabled. The weakness is a classic data‑race (CWE‑820).

All Linux kernels that ship the mac802154 driver with low‑level security enabled are potentially vulnerable. Embedded devices, IoT endpoints, and other system installations that utilize 802.15.4 communication fall into this category. Because the fix is isolated to a single commit adding skb_cow_data() before crypto, any kernel that has not applied that patch remains in risk.

The CVSS score of 8.8 classifies this as high severity. The EPSS score of less than 1 % indicates a very low current exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker could send crafted IEEE 802.15.4 frames to a target running a vulnerable kernel with security enabled, causing the in‑place crypto path to corrupt shared memory or cause a crash. Because the flaw resides entirely in kernel‑level code, no privileged user access is required, but the attacker must be able to transmit on the 802.15.4 network.