The Linux kernel’s mac802154 wireless driver contains a use‑after‑free flaw. The scan worker obtains a reference to the interface only under an RCU read lock and then continues to dereference the netdev after that lock is released and the rtnl context is dropped. A concurrent interface deletion or PHY removal can unregister the device while the worker is still running, freeing the netdev asynchronously. Because the worker does not hold a stable reference, it may dereference the freed memory, which is reported by KASAN as a slab-use-after‑free. This kernel memory corruption could crash the system or allow a privileged attacker with CAP_NET_ADMIN to execute arbitrary code at kernel level.

All Linux kernel releases that contain the mac802154 driver are affected. The CPE indicates the vulnerability applies to every Linux kernel regardless of vendor or version; the known vendor list is simply the Linux kernel community.

The CVSS score is 4.1, reflecting a moderate severity. The EPSS score is below 1 %, suggesting a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a local attacker who can trigger a scan operation while simultaneously deleting or removing the interface, and the attacker must possess CAP_NET_ADMIN privileges. These prerequisites make the attack vector a local privilege escalation scenario, not exploitable over the network.