In the Linux kernel, an improper removal of mac802154 interfaces from a read–clean‑up (RCU) list was detected. The removal path used the standard list_del() routine instead of list_del_rcu(), allowing an asynchronous transmit completion routine to access a list node that had already been freed. This error can cause a use‑after‑free memory corruption, which is a classic vector for kernel faults and may be exploited to gain elevated privileges or crash the system.

All Linux kernel releases that employ the mac802154 driver and lack the patch referenced in commits 2039f27b1a0c997137a5de7f8a3cee0e80fbf952 and related changes are potentially impacted. The vulnerability applies to the generic Linux kernel, affecting any environment where IEEE 802.15.4 wireless interfaces are created and removed.

The vulnerability is a kernel memory corruption flaw that can result in local privilege escalation or denial of service. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog. The likely attack vector requires an attacker with the ability to create and delete mac802154 interfaces, which typically means local or somewhat privileged access. Given the severity of the potential kernel crash or privilege gain and the absence of known public exploits, the risk remains significant in environments that use 802.15.4 networking.