The mt76 Wi‑Fi driver frees an offchannel link structure with a plain kfree() immediately after assigning NULL via rcu_assign_pointer. RCU only blocks future readers, not those already holding the pointer, so a TX softirq that dereferences the link just before the NULL assignment will access freed memory under rcu_read_lock. This use‑after‑free can corrupt memory, trigger a kernel panic, or provide an opportunity for code execution or privilege escalation.

All Linux kernel builds that contain the unpatched mt76 driver are potentially affected. No specific kernel release numbers are supplied, but any kernel importing the Linux:Linux vendor product and including the mt76 driver before the patch commit risk exposure.

The CVSS score of 7.8 indicates a high‑severity use‑after‑free in this kernel driver, posing a significant risk to kernel stability and security. The EPSS score is < 1%, indicating a very low exploitation probability at present. The vulnerability is not listed in the CISA KEV catalog, indicating no known active exploitation at this time. Attackers would need to trigger the TX datapath while the freed object is still referenced; the exact remote or local attack vector is not specified, so the risk is treated as a potential local privilege escalation that could expand if an attacker gains sufficient control over network traffic handled by the device.