The vulnerability is a concurrency flaw in the Linux kernel's mac80211 Wi‑Fi subsystem where a use‑after‑free occurs when a Block Acknowledgement (BA) session is stopped. In the ieee80211_stop_tx_ba_cb function, the tid_tx structure is freed by kfree_rcu() and then accessed again without a proper RCU read‑side critical section. This leads to an out‑of‑band read that can corrupt kernel memory and potentially allow an attacker to execute arbitrary code in kernel mode or cause a denial of service.

All Linux kernel builds containing the mac80211 Wi‑Fi driver before the application of the fix, including mainstream distributions and custom kernels that incorporate the vulnerable code. No specific versions were cited, so any system running a kernel that hosts the outdated mac80211 subsystem should treat this as a high‑risk condition until the patch is applied.

The CVSS score of 8.8 reflects the high severity of a kernel memory corruption that can lead to privilege escalation. The EPSS score of < 1% indicates a low probability of exploitation under normal circumstances. The flaw can be triggered by Wi‑Fi operations that stop a BA session, such as local station teardown, session timeouts, or a rekeying event, as described in the source. Although this opportunity does not rely on a network‑connected attacker but rather on control of the wireless interface or a user‑land process with sufficient privileges, the kernel space nature of the bug still allows broad impact if exploited. The issue is not listed in the CISA KEV catalog, so no active exploitation is known yet.