The brcmsmac Wi‑Fi driver in the Linux kernel contains a use‑after‑free flaw in the brcms_free_timer() function. The bug allows the timer’s structure to be freed while its callback is still executing, leading to a memory corruption that can be exploited for arbitrary code execution or a denial‑of‑service condition. The flaw is a classic use‑after‑free under CWE‑416 and it is triggered when the timer callback (_brcms_timer) races with the deallocation routine, as the original cancel_delayed_work() does not wait for in‑flight callbacks to finish.

This vulnerability affects Linux kernel systems that load the brcmsmac wireless driver. It applies to any distribution or custom kernel build that includes the brcmsmac driver prior to the patch committed in the kernel source tree (see commit hashes 050d2486e8ed2c0a23b87249 and 10eeb0b29fd7f52487c9ae573e8d79c210a0095d). The listed vendor product is the Linux kernel; detailed affected kernel versions are not specified by the CNA, so systems should consider the presence of these commits as the determining factor.

The CVSS score of 7.0 indicates moderate to high severity, and the EPSS score of < 1% signals a low current likelihood of exploitation. Although the flaw can lead to arbitrary code execution, it is not currently listed in the CISA KEV catalog, suggesting no widespread exploitation. The risk remains significant because the flaw occurs in kernel space and can be leveraged by an attacker with local privileges, or potentially through a race condition that escalates privileges in vulnerable contexts.