The Linux kernel’s cc2520 IEEE802154 driver contains a use‑after‑free defect in the FIFOP interrupt handler. During device removal, the driver flushes pending work but does not disable the work queue, allowing the interrupt handler to enqueue the same work again after the flush. The worker then executes after the driver’s private data has been freed, corrupting kernel memory and potentially causing a panic or enabling code execution. Based on the description, it is inferred that an attacker would need local access to the device to trigger removal or active traffic to stimulate the handler.

Any system running a Linux kernel that includes the cc2520 driver prior to the commit that introduced disable_work_sync() (identified by 56a9919) is affected. Versions compiled with the legacy driver, regardless of kernel major release, must be verified for the presence of the fix or the upstream patch. The vulnerability is specific to the cc2520 radio module within the ieee802154 subsystem.

The flaw has a CVSS score of 5.5, indicating moderate severity. The EPSS score is reported as <1%, showing a very low projected exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a local user with privileged access to the device; it is inferred that the attacker would cause device removal or active traffic to trigger the handler. Because the bug is a classic use‑after‑free, successful exploitation could lead to a kernel panic or privilege escalation should an attacker manage to influence the memory state.