An attacker that can cause the mac80211 Wi‑Fi subsystem to fail to allocate a new housekeeping object may trigger a double free; the kernel first queues the old object for RCU‑based release and then attempts to free it again if the allocation fails. The resulting double free leads to kernel memory corruption and, potentially, arbitrary code execution. This weakness is a classic example of a double free bug.

The flaw resides in the Linux kernel’s mac80211 implementation and affects any Linux kernel that includes the unsol_bcast_probe_resp handling before the fix commit. All kernels that compile the current mac80211 source before the patches identified in the reference commits (0ace76e410d7f…, 1d067abcd37062426c59ec73dbc4e87a63f33fea, ca27a81cd77b698e5eb586a011bee6800c7ee4bd, d62b55b7c7dc62887d7fd5648fb38f0bfaef53ae) are potentially vulnerable. Devices running unpatched Linux kernels with Wi‑Fi support are thus at risk.

With a CVSS score of 7.8, the vulnerability is classified as high severity, and an EPSS score of <1% indicates a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The double free is a high severity kernel bug, but there is currently no evidence of a publicly available exploit. The likely attack vector is a local or privileged user who can force an allocation failure or otherwise manipulate the Wi‑Fi driver. Given the low exploitation probability and the necessity of kernel access, the overall risk remains moderate; however, patching remains the recommended course of action.