The Linux kernel contains a flaw in the mac802154 wireless driver where the scanning worker retains an interface reference only under an RCU read lock and then continues to dereference the net device after that lock is released and the rtnl context is dropped. When a concurrent interface deletion or PHY removal occurs, the net device can be unregistered while the worker still holds a dangling pointer, triggering a slab use‑after‑free that is detected by KASAN. This kernel memory corruption can lead to arbitrary code execution with the privileges of the executing process, possibly allowing a local user with CAP_NET_ADMIN to gain higher privileges or crash the system.

All Linux kernel releases that contain the mac802154 driver are affected; no specific vendor or kernel version is listed in the CNA data. The issue exists in the mainstream kernel source and should be considered present until the fix is merged into a released kernel.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploits at the time of this analysis. Nonetheless, the use‑after‑free requires a local user with administrative privileges (CAP_NET_ADMIN) to trigger a race between a scan request and an interface deletion. The impact is a potential kernel crash or privilege escalation, which would be severe if exploited. Given the lack of evidence for widespread exploitation, the immediate risk is moderate but the severity warrants prompt patching.