The Linux kernel’s mac802154 driver contains a use‑after‑free in the beacon worker routine. When a wireless interface is torn down, the beacon worker continues to use a reference to the freed netdev private area after the RCU read lock is released. This causes a kernel memory corruption that leads to a crash, resulting in a denial‑of‑service for the affected system. The vulnerability is a classic invalid pointer dereference (CWE‑825) and does not provide direct arbitrary code execution.

All Linux kernel builds that ship the mac802154 IEEE 802.15.4 driver are affected. No explicit version range is listed, so any kernel containing the unpatched beacon_worker implementation is vulnerable. This includes the standard Linux distribution kernels and any custom builds that include the mac802154 module.

Because the flaw is a use‑after‑free that triggers a kernel crash, the CVSS score of 7.8 reflects a high severity, but the exploitability depends on the attacker’s ability to trigger the beacon worker after interface removal. The EPSS score of 0.00168 (approximately 0.168%) indicates a very low but non‑zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local—an attacker with control over the system could issue an interface removal command while beaconing. Remote exploitation via crafted wireless frames could be possible if an attacker can force the beacon worker to run after teardown, but such a pathway is not confirmed in the description. Given the relatively high severity of a kernel crash, the risk warrants urgent mitigation.