The fix addresses a double‑free bug in the Linux kernel's mac80211 Wi‑Fi stack. The issue arises when ieee80211_set_fils_discovery() attempts to replace a fils_discovery template: if the allocation fails, the old template is already queued for free, then later freed again during RCU processing, leading to a KASAN double‑free error and a kernel crash. Based on the description, it is inferred that an attacker could trigger the failing allocation path by sending crafted Wi‑Fi management frames to the device, causing a denial‑of‑service through the crash.

All Linux kernel builds that include the mac80211 stack and use fils_discovery before the patch commits from 1981fba7 and related changes are vulnerable. The affected kernel versions span any release that contains the unpatched code, as no specific version range is provided in the disclosure.

The CVSS score is 7.8. The EPSS score is less than 1%, and the issue is not listed in CISA’s KEV catalog. Based on the description, it is inferred that exploitation would likely require an attacker with local or remote control of Wi‑Fi management frames, making the attack vector potentially remote or local depending on device configuration. Given the absence of active exploit evidence, the current risk remains primarily the potential for a crash, though the high severity warrants timely mitigation.