The iwlwifi driver for Linux contains a flaw where, after a remain-on-channel operation, a P2P‑Device is removed from its binding but the associated PHY context is retained as a cache. When the same P2P‑Device is later re‑added by unrelated code, the driver attempts to use the stale context and the firmware crashes. This causes a loss of Wi‑Fi functionality; no code execution is achieved, but the crash constitutes a denial‑of‑service fault in the network subsystem.

Linux kernel installations that include the iwlwifi driver and have not yet applied the commit that introduces a boolean guard for P2P‑Device binding restoration. All distributions shipping kernels pre‑commit 7be2fc679c8f657868988e41c0bb15bf5a454620 are affected. The problem is limited to hardware that uses the iwlwifi driver for Intel wireless chips.

The issue is a use‑after‑free leading to a firmware crash, a local denial‑of‑service condition. EPSS is not available and the vulnerability is not listed in CISA's KEV catalog, indicating no evidence of widespread exploitation. The CVSS score, while not provided, would reflect high impact for availability. Attack execution requires interaction with the Wi‑Fi stack and can be triggered through a specific sequence of channel operations; thus the vector is local and limited to devices capable of performing a P2P remain‑on‑channel cycle.