In the Linux kernel the libertas_tf driver contains a use‑after‑free bug. When the device is removed or a firmware command times out, the adapter’s command timer callback may run concurrently with the teardown code and dereference memory that has already been freed. This memory corruption can lead to a kernel crash or arbitrary code execution, thus enabling an attacker with access to the wireless interface to gain elevated privileges.

The vulnerability is present in the Linux kernel’s libertas_tf driver. No specific kernel version range is listed, so any distribution that loads this driver could be affected. Users operating the libreOTA hardware with this driver should verify whether their current kernel includes the patch.

The CVSS score of 5.5 and EPSS score of < 1% indicate moderate exploitation likelihood, but the use‑after‑free flaw can still lead to severe kernel memory corruption. It is not yet listed in the CISA KEV catalog, and no public exploit has been reported as of the latest data. Nonetheless, the potential impact is severe and exploitation could be feasible if an attacker can trigger a firmware command timeout while the adapter is being removed. The risk is therefore considered high for systems that run the affected driver.