The vulnerability originates in the libertas_tf Wi‑Fi driver, where the function lbtf_free_adapter() frees command buffers before ensuring an associated timer callback has finished. If the callback runs after the memory has been released, it dereferences freed memory, which can corrupt kernel memory or, in worst case, allow an attacker to execute arbitrary code by influencing the freed data.

The flaw affects the Linux kernel’s libertas_tf driver in any kernel compilation that lacks the commit swapping the order of lbtf_free_cmd_buffer() and timer_delete_sync(). No explicit version range is provided, so any kernel built without that order correction may be vulnerable.

The EPSS score is reported as less than 1%, indicating a very low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, and no public exploitation evidence is available. The most likely attack vector is local, involving interactions with the Wi‑Fi subsystem that trigger the timer callback during driver teardown or firmware operations. Under suitable conditions, an attacker with sufficient access to Wi‑Fi operations could crash the kernel or potentially achieve arbitrary code execution if the freed data can be controlled. The CVSS score of 5.5 indicates moderate severity.