The Linux kernel’s iwlegacy wireless driver contains a logic error in the error path of __il4965_up(). In that path, il_dealloc_bcast_stations() clears only the IL_STA_UCODE_ACTIVE flag while leaving IL_STA_BCAST set. As a result, when __il4965_down() later executes, it attempts to deallocate the same broadcast station again. This duplication can be triggered when the RF_KILL switch is toggled during driver initialization. The CVE description does not report a crash or other severe outcome; it only states that the deallocation occurs twice. Therefore, the impact is limited to a potential mis‑management of station state, which could lead to temporary instability or a brief denial‑of‑service in the wireless stack.

All Linux kernels that include the iwlegacy driver before the patch commit, as listed with the vendor/product pair Linux:Linux. The specific kernel releases are not enumerated in the advisory, so any build that contains the bug in the commit timeline before the fix is vulnerable.

The CVSS score of 5.5 reflects moderate severity and the EPSS score is less than 1%, indicating a low exploitation probability. The vulnerability is not present in CISA’s KEV catalog. Because the flaw manifests only when RF_KILL is toggled during driver startup, an attacker must have local or privileged access to the device to control the RF_KILL state or to force the driver to load during boot. With these constraints the risk is modest, but a local attacker who can manipulate the RF_KILL switch may trigger a connectivity drop or a brief service interruption.