The iwlwifi driver in the Linux kernel contains a flaw where a P2P‑Device can be removed from its binding after a remain‑on‑channel operation while its PHY context is retained as a cache. If a subsequent binding update re‑adds the same P2P‑Device, the driver attempts to use the stale context, causing a firmware crash. This results in a loss of Wi‑Fi functionality; no code execution is achieved, but the crash constitutes a denial‑of‑service fault in the network subsystem. The weakness is a use‑after‑free scenario identified as CWE‑825.

Linux kernel installations that include the iwlwifi driver and have not yet applied the commit that introduces a boolean guard for P2P‑Device binding restoration. All distributions shipping kernels pre‑commit 7be2fc679c8f657868988e41c0bb15bf5a454620 are affected. The problem is limited to hardware that uses the iwlwifi driver for Intel wireless chips.

The vulnerability is a local denial‑of‑service condition; the likely attack vector requires interaction with the Wi‑Fi stack and can be triggered through a specific sequence of channel operations. EPSS is < 1%, and the vulnerability is not listed in CISA's KEV catalog, indicating no evidence of widespread exploitation. The CVSS score of 5.5 reflects moderate impact on availability. While the description itself implies a local exploitation scenario, the exact external reach of the flaw is inferred based on the need to manipulate Wi‑Fi channel operations from the device side.