The flaw in the Linux mac80211 subsystem allows a failed attempt to join a Wi‑Fi mesh network to leave a channel context unreleased. When the interface is later removed, the driver tries to unassign that context after it has already been removed from the kernel, triggering a warning and potentially a kernel panic. This resource mismanagement flaw can bring the entire system down, resulting in a loss of availability.

Any Linux kernel that includes the mac80211 wireless stack before the change that releases the channel context on start failure is affected. Distributions that ship an unpatched kernel image or compile the kernel from source without the upstream patch are susceptible. The flaw exists in the core kernel, not in individual modules, so all installations of those kernel versions are at risk.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score remains less than 1%, suggesting a low probability of widespread exploitation. The vulnerability requires the ability to initiate a mesh join and then remove the interface, which can be obtained via local or elevated privileges. If those prerequisites are met, the likelihood of a successful crash is high, making the risk moderate to high for affected environments. The issue is not listed in the CISA KEV catalog. The likely attack vector is local; a malicious process with sufficient privileges could trigger the vulnerable sequence by manipulating mesh interfaces.