The virt_wifi driver of the Linux kernel transfers a device’s operational state before the device is registered. If registration fails—such as when an invalid device name is supplied—the driver frees the device structure immediately, while a previously queued link watch event still holds a reference to that structure. This sequence causes a use‑after‑free that can corrupt kernel memory, potentially enabling local privilege escalation or system compromise.

Any Linux distribution or kernel build that includes the virt_wifi driver is potentially affected, regardless of the specific kernel version, because the flaw resides in the driver’s registration logic.

The CVSS score of 7.8 reflects a medium‑to‑high severity risk, while the EPSS score of <1% indicates an exceptionally low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. Exploitation requires local access to trigger a registration failure and a subsequent link watch event, so it is unlikely to be widely exploited but could be leveraged by a determined attacker with local privileges, or during system boot if the kernel loads an invalid device name.