The vulnerability arises when the Linux kernel's mac80211 subsystem frees SKBs from the AP_VLAN buffer outside of the required IRQ lock. This improper synchronization allows SKBs with TX status to be freed while the lock is lost, potentially invoking cfg80211/nl80211 paths that report dropped frames to userspace and may reach netlink tap transmit. If an attacker can trigger this race—such as by sending crafted multicast frames or stopping the AP_VLAN while SKBs are queued—the system may experience unhandled frame drops, incorrect netlink notifications, or even a crash, effectively disabling Wi‑Fi connectivity for the affected host.

The flaw exists in the Linux kernel, affecting all builds of the kernel where the mac80211 AP_VLAN code compiles. No specific version range is given, so any kernel that uses the default mac80211 stack is potentially vulnerable. The main affected component is the Wi‑Fi subsystem in the kernel; other hardware or firmware components are indirectly impacted only if they rely on the kernel's networking stack.

The advisory does not provide a CVSS score or EPSS value, and the vulnerability is not listed in CISA's KEV catalog. Based on the description, the likely attack vector involves an attacker with access to the wireless network fabric—either locally or via a rogue access point—crafting frames that trigger the race condition. Exploitation would require the attacker to influence the ordering of operations in ieee80211_do_stop() and the subsequent skb freeing, which is a complex scenario but not impossible on systems where the radio is exposed to untrusted traffic.