In the Linux kernel’s mac80211 stack, a flaw in the handling of new link allocations during a vif update can leave dangling debugfs references when the driver fails to apply the links. The error path reallocates link containers, registers debugfs entries tied to those containers, and then frees them without removing the debugfs files or stopping the links. A subsequent read of the debugfs file dereferences freed memory, triggering a use‑after‑free. This bug can be escalated to arbitrary kernel code execution or a kernel panic, compromising system integrity and stability. The vulnerability is a classic kernel use‑after‑free and is insufficiently secured against malicious use.

All Linux kernel installations running mac80211 wireless drivers, regardless of distribution. The bug affects any kernel that has not applied the patch commit that removes debugfs entries and stops links on error. No specific version range is supplied in the entry; therefore, any current kernel that has not been back‑patched for this flaw is vulnerable.

The CVSS score is not provided, and EPSS data is unavailable; thus the public exploitation probability cannot be quantified. The bug is not listed in CISA’s KEV catalog, indicating no widely known active exploit. However, because the flaw resides in privileged kernel code and can be triggered by local users who control wireless interface updates, the risk to local users is high. An attacker could achieve kernel compromise by executing privileged commands or causing a system crash via normal Wi‑Fi configuration maneuvers.