The Linux kernel’s wireless configuration subsystem contains a race that can deadlock the kernel. When a netlink socket that owns a PMSR session is closed while the interface is being torn down, the scheduler must cancel work that also requires the same wiphy_lock. The work function and the teardown path lock the same resource in conflicting ways, so neither thread can proceed. Operating systems running this code can therefore hang or crash in response to that timing collision. The vulnerability is a classic race leading to a deadlock (CWE‑362) and a system‑level denial of service.

All Linux kernel distributions that include the legacy cfg80211 implementation of pmsr_free_wk are impacted. The fix converts the work structure to a wiphy_work, and the change is present in various kernel versions after commit 21512b5f7a74fd18c996c22e6854efe57d570816. Therefore, any kernel prior to that commit on any major distribution—Debian, Ubuntu, Red Hat, CentOS, Fedora, Arch, etc.—is considered vulnerable until the patch is applied. No specific version range is published, so the safe assumption is that all kernels that have not yet merged this commit are affected.

The CVSS score and EPSS are not publicly disclosed, and the vulnerability is not in the CISA KEV catalog. Exploitability is inferred: an attacker must initiate a concurrent netlink socket close and interface shutdown, a scenario that generally requires local or elevated privileges to manipulate network interfaces or to run privileged processes that interact with the kernel. Because the trigger requires direct interaction with kernel internals, it is unlikely to be exploitable remotely without higher privileges. The risk is therefore moderate, with a relatively high impact (system lockup or crash) if the scenario is triggered within a privileged context.