The flaw resides in the Linux kernel’s cfg80211 subsystem, where a scheduled‑scan result work item can be queued even after a wireless device has been unregistered. The work callback retrieves the registered device, locks the wiphy, and traverses the scheduled‑scan request list. Because wiphy_unregister() drains unrelated work items but does not cancel the sched_scan_res_wk, the queued work can run after the device has been freed, triggering a use‑after‑free that can corrupt kernel memory or allow execution of arbitrary code. The vulnerability stems from improper synchronization and inadequate resource‑management checks, related to CWE‑825 for failing to manage the life‑time of scheduled scan resources. The resulting kernel memory corruption can lead to crashes or potentially arbitrary code execution at kernel level.

All Linux kernel implementations that include the cfg80211 module without the recent patch are affected. The fix was applied in the commit identified by 308ffdf575560d7e7b8b21f1e3ca6276630f73bf, and all kernel releases that incorporate that change are considered safe. Systems running earlier kernel versions or devices that have not applied the patch remain vulnerable.

With a CVSS score of 7.5, the vulnerability is considered high severity. The EPSS score of < 1% indicates a low probability of exploitation, and it is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a local or privileged attacker that can invoke Wi‑Fi scheduled scan APIs and subsequently unregister the device. This requires the ability to trigger a device teardown sequence, which is not typically available to normal unprivileged users, so remote exploitation is unlikely without additional local compromise. The flaw can be used to crash the kernel or, in the case of an unpatched kernel, could offer a vector for kernel‑level code execution if an attacker can attain sufficient local privileges.