The vulnerability is a use‑after‑free bug in the mac802154 driver within the Linux kernel. When the driver receives beacon or MAC‑command frames, the softirq producer enqueues the packet and stores a pointer to the interface’s driver state (sdata) without taking a reference or acquiring a lock. If the interface is removed while a frame is queued, a worker later dereferences this dangling pointer, corrupting kernel memory. This can lead to a kernel crash causing a denial of service or, if the attacker can influence the contents of the freed memory, to arbitrary execution of code with kernel privileges. The flaw is triggered by legitimate driver logic and does not require any special privileges on the attacker side; it is sufficient for the attacker to send malicious frames on the 802.15.4 air interface and then cause the interface to be removed. Because the bug involves the kernel’s use of memory after freeing, it is a high‑severity vulnerability reaching the privileges of the kernel and can have system‑wide impacts.

All Linux kernel releases that include the mac802154 driver before the documented fix are affected. The driver is part of the mainline kernel and is installed in many distributions, especially on devices that implement Zigbee, Thread, or other 802.15.4‑based protocols. Any Linux system that builds the kernel with mac802154 enabled is at risk.

The CVSS score of 7.5 indicates high severity. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, implying that no widely known exploitation exists at present. The attack vector is network‑based: an adversary must be able to inject crafted 802.15.4 frames onto the target’s wireless interface, which can be achieved by proximity or by compromising a participating node on the network. The race condition is triggered by normal driver behavior, so the attack does not require privileged local access. In the absence of public exploits, the likelihood of real‑world exploitation remains uncertain; however, the use‑after‑free condition provides a path to either a crash (Denial of Service) or potential arbitrary code execution if the attacker can control the freed memory.