The Linux kernel’s mac80211 wireless stack has a race condition that arises during IBSS disconnection. When the carrier is turned off, the system immediately tells the driver to leave the IBSS while packets can still be transmitted across CPUs, resulting in the driver accessing invalid queues and potentially causing a kernel crash and loss of network service. This defect matches a classic concurrent execution race with improper synchronization.

All Linux kernel releases that use the mac80211 stack and do not include the commit that reorders carrier‑off with station flushing are susceptible. No vendor‑specific version list is supplied, so any kernel lacking the patch indicated by the linked commits is potentially vulnerable, regardless of distribution.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score is < 1%, suggesting a low likelihood of exploitation. The vulnerability is not listed in CISA KEV. The likely attack vector involves a local attacker who can influence wireless traffic or force an IBSS disconnection; this inference is drawn from the description that the race occurs around a disconnect event. Because the defect can lead to a kernel crash, the impact is significant, though publicly documented exploits are not known and overall exploitation likelihood appears low without a specialized tool.