A race condition exists in the Linux kernel’s cfg80211 wireless subsystem that is triggered when a device joins an IBSS. During the join the kernel records only the BSSID and channel in an event and later looks up the corresponding BSS entry for processing. If a concurrent scan with the NL80211_SCAN_FLAG_FLUSH flag removes that BSS entry before it is looked up, the kernel dereferences a missing or freed entry, resulting in a warning in the cfg80211 event work queue. This flaw represents a classic race condition weakness (CWE‑366) and can lead to unwanted log output but does not trigger a crash or denial of service.

The vulnerability is present in all Linux kernel builds that have not yet incorporated the patch at hashes 708f9d43d6a2eb9c6b83fe62af628de9dffd9314 and b0e3f019e461ac42e45aa3ec1216cefaca2f4a8b. Any system shipping a kernel before these commits, or any custom kernel that uses the unpatched cfg80211 module, is potentially affected.

The CVSS score of 5.5 indicates medium severity, while the EPSS < 1% shows a very low exploitation probability. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that the attack vector is local control over a wireless interface that can issue scan flush requests while an IBSS is active. An attacker with such local access can trigger the race and generate a warning, but no code execution or system compromise is documented. Because the vector is local, the risk is low unless the system is exposed to untrusted users or processes.