The flaw appears when the iwl_pcie_tx_init routine fails and the driver unwinds via iwl_pcie_rx_free. The released RX objects remain set to non‑NULL pointers on the live transport object. If the interface is later torn down, retried, or otherwise accessed, the stale pointers can be dereferenced, causing a kernel panic and a loss of system access.

All Linux kernel builds that include the unpatched iwlwifi PCIe Wi‑Fi driver are affected. This includes any distribution that ships a kernel version older than the patch that removes the stale RX pointers. Users should check their kernel version and distribution security advisory to determine if the fix has been applied.

The CVSS score for this issue is 7, indicating a high severity. The EPSS score is < 1%, indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The use‑after‑free could lead to an unconditional kernel crash when the driver is initialized and subsequently cleaned up or retried. The attack requires that the flaw be triggered by a failure during initialization, which can happen naturally or during normal Wi‑Fi operation, making the risk primarily a denial‑of‑service to local users.