The flaw occurs in the Linux kernel’s cfg80211 subsystem, where a scheduled‑scan result work item can be queued even after the wireless device has been unregistered. When the work item subsequently runs, it dereferences the freed device object, causing a use‑after‑free that can crash the kernel or allow an attacker to execute arbitrary code at kernel privilege level. The impact is therefore high: potential remote code execution or denial of service.

All Linux kernel implementations that include the cfg80211 module without the recent patch are affected. The fix was applied in the commit identified by 308ffdf575560d7e7b8b21f1e3ca6276630f73bf, and all kernel releases that incorporate that change are considered safe. Systems running earlier kernel versions or devices that have not applied the patch remain vulnerable.

Although a CVSS score is not provided, the nature of the bug—a use‑after‑free in kernel space—generally rates as critical. The EPSS score is unavailable, so the current exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to trigger a scheduled scan and coordinate a device teardown, which may require local privilege or the ability to manipulate wireless drivers, making this risk higher on compromised hosts or machines with exposed wireless management interfaces.