The flaw occurs in the Linux kernel’s mac80211 subsystem when new wireless links are added during a virtual interface update. If the driver fails to apply the new links, the error path frees the link containers without removing the associated debugfs entries or stopping the links. A later read of a debugfs file then dereferences the freed memory, causing a use‑after‑free that results in a kernel panic or general protection fault.

All Linux kernel installations that include the mac80211 wireless stack and have not incorporated the patch that removes debugfs entries and stops links on the error path. This applies to every distribution using the standard Linux kernel because the impacted code is part of the kernel source tree.

The CVSS score of 7.8 denotes high severity, while the EPSS score indicates a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, meaning no widely known active exploits have been reported. It is uncertain from the CVE description whether a local user can trigger the flaw; based on the code flow, it is inferred that a local user who performs wireless configuration operations that cause the driver to fail could activate the error path, potentially leading to a crash or providing an avenue for privilege escalation if additional vulnerabilities exist.