Based on the description, it is inferred that a Receiver‑Only‑Channel operation may begin while a scan is in progress. The kernel logic can queue a new ROC after the scan starts, producing a warning message in the kernel logs once the scan completes. This race condition could destabilize the system, though the public description does not demonstrate a crash.

All Linux kernel builds that include the mac80211 wireless stack are potentially vulnerable, since the fix was applied in upstream kernel source. No specific version numbers are listed, so any kernel version prior to the upstream patch may be affected.

The EPSS score of less than 1% indicates a low likelihood of exploitation. The flaw is not in the CISA KEV catalog and no public exploit exists. Based on the description it is inferred that exploitation would require initiating a wireless scan and then a ROC request, which could be done locally or via a compromised wireless interface. The CVSS score of 5.5 indicates moderate impact. With no available exploit, the risk remains low to moderate but remediation is advised.