The Linux kernel’s wireless configuration subsystem contains a race that can deadlock the kernel. When a netlink socket that owns a PMSR session is closed while the interface is being torn down, the scheduler must cancel work that also requires the same wiphy_lock. The work function and the teardown path lock the same resource in conflicting ways, so neither thread can proceed. Operating systems running this code can therefore hang or crash in response to that timing collision. The vulnerability is a classic race leading to a deadlock (CWE‑362) and a system‑level denial of service.

All Linux kernel distributions that include the legacy cfg80211 implementation of pmsr_free_wk are impacted. The fix converts the work structure to a wiphy_work, and the change is present in various kernel versions after commit 21512b5f7a74fd18c996c22e6854efe57d570816. Therefore, any kernel prior to that commit on any major distribution—Debian, Ubuntu, Red Hat, CentOS, Fedora, Arch, etc.—is considered vulnerable until the patch is applied. No specific version range is published, so the safe assumption is that all kernels that have not yet merged this commit are affected.

The CVSS score of 5.5 alongside an EPSS score under 1% points to a medium severity threat with a low likelihood of exploitation. An attacker would need to orchestrate a concurrent netlink socket close and interface shutdown, typically requiring local or elevated privileges to manage network interfaces or to run privileged processes that can interact with the kernel. Because the trigger demands direct interaction with kernel internals, it is unlikely to be exploitable remotely without higher privileges. The risk remains moderate, with a relatively high impact (system lockup or crash) if the scenario is triggered within a privileged context.