A double free occurs in the Linux mac80211 Wi‑Fi stack when allocating a new fils_discovery template fails; the old template is freed prematurely and later freed again during RCU processing, triggering a KASAN error and a kernel crash. The vulnerability can be leveraged by an attacker who can initiate the failing allocation path—such as by sending crafted Wi‑Fi management frames—to cause a denial‑of‑service on the affected device.

All Linux kernel builds that include the mac80211 stack and use fils_discovery before the patch commits from 1981fba7 and related changes are vulnerable. The affected kernel versions span any release that contains the unpatched code, as no specific version range is provided in the disclosure.

The CVSS score is not published, but the nature of the bug (kernel memory corruption leading to a crash) suggests a high severity. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog. Exploitation would likely require an attacker with local or remote control of Wi‑Fi management frames, making the attack vector potentially remote or local depending on device configuration. Given the lack of active exploit evidence, the current risk remains primarily the potential for a crash, though the high severity warrants timely mitigation.