The Linux kernel cfg80211 wireless subsystem suffered a race condition where an autodisconnect work item could be queued after its underlying wdev structure had been removed. Because the work was executed as a plain work_struct, the kernel could reference freed memory, potentially leading to a crash or denial of service. This use‑after‑free scenario is classified as CWE‑367, representing a race condition that allows a dangling reference to be used. The flaw arises from the handling of NETLINK_GENERIC socket releases while a wireless connection is active.

All Linux kernel distributions are affected; specific version information is not provided. The vulnerability manifests in the core cfg80211 subsystem, which is included in every Linux kernel release that supports wireless networking.

There is no publicly known exploit and the EPSS score of < 1% implies a low expected exploitation probability. The CVSS score of 7.8 indicates high severity; this risk arises from a race condition that can result in a kernel crash when a NETLINK_GENERIC socket tied to a wireless interface is released while the device is in the process of an autodisconnect. The likely attack vector is local: an attacker would need the ability to open and close a NETLINK socket that interacts with cfg80211, potentially through userspace applications. Successful exploitation would lead to a denial of service rather than privilege escalation or remote code execution.