An attacker that can cause the mac80211 Wi‑Fi subsystem to fail to allocate a new housekeeping object may trigger a double free; the kernel first queues the old object for RCU‑based release and then attempts to free it again if the allocation fails. The resulting double free leads to kernel memory corruption and, potentially, arbitrary code execution. This weakness is a classic example of a double free bug (CWE‑415).

The flaw resides in the Linux kernel’s mac80211 implementation and affects any Linux kernel that includes the unsol_bcast_probe_resp handling before the fix commit. All kernels that compile the current mac80211 source before the patches identified in the reference commits (0ace76e410d7f…, 1d067abcd37062426c59ec73dbc4e87a63f33fea, ca27a81cd77b698e5eb586a011bee6800c7ee4bd, d62b55b7c7dc62887d7fd5648fb38f0bfaef53ae) are potentially vulnerable. Devices running unpatched Linux kernels with Wi‑Fi support are thus at risk.

No CVSS or EPSS score is published and the vulnerability is not listed in the CISA KEV catalog. The double free is a severe kernel bug, but there is currently no evidence of a publicly available exploit. The likely attack vector is a local or privileged user who can force an allocation failure or otherwise manipulate the Wi‑Fi driver. Given the lack of known exploitation and the necessity of kernel access, the overall risk is moderate; however, patching remains the recommended course of action.