The vulnerability arises in the mac80211 Wi‑Fi stack of the Linux kernel. When a Multi‑Link Operation (MLO) link is removed, the code frees the per‑CPU statistics buffer immediately while only deferring the link container’s cleanup via RCU. Readers in the fast‑path RX code can still access the stale buffer after the link container has been freed, which is a use‑after‑free race condition. This flaw maps to common weaknesses such as use‑after‑free, race condition, and improper resource deallocation, and can lead to kernel memory corruption, crashes, or denial of service. Based on the description, the likely attack vector involves Wi‑Fi traffic that triggers the removal of a link.

All Linux kernel installations that contain the removal code for MLO links and are prior to the commit that defers the entire cleanup to a single RCU callback. This includes every distribution that ships a kernel version deploying the affected mac80211 code. No specific version list is supplied; any system with a kernel that predates the fix is vulnerable.

Based on the description, the likely attack vector is network traffic that activates the link removal routine in the kernel’s Wi‑Fi stack. The short‑lived race condition is difficult to trigger reliably, and the EPSS score is below 1 %, indicating a very low expected exploitation rate. However, the high CVSS score of 8.8 reflects severe potential impact if an attacker succeeds, and the issue is not catalogued in CISA’s KEV list. Attackers would need to orchestrate Wi‑Fi traffic that aligns with a link removal event to provoke the use‑after‑free. While practical exploitation is unlikely, the possibility of kernel crashes or memory corruption warrants immediate remediation.