This vulnerability is a use‑after‑free in the Linux kernel’s cfg80211 subsystem. When a wireless interface is brought down while a scan is in progress, the kernel prematurely frees the scan request that the driver still believes it owns. The resulting outstanding reference in cfg80211::scan_done() can corrupt kernel memory, cause a crash, or, if exploited, elevate privileges to the kernel level.

The flaw exists in the upstream Linux kernel and applies to any distribution that has not incorporated the patch that removes the premature free. The affected component is the cfg80211 driver interface. Kernels prior to the commit cf6da29d17994865f73ca70976495ea856909c63 are vulnerable; distributions using those kernels must upgrade to a patched release.

With a CVSS score of 7.8 the severity is moderate, but the EPSS is less than 1 %, indicating a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to control a malicious wireless driver or trigger a scan‑interface down sequence; the attack surface is limited, but the potential impact includes kernel memory corruption and privilege escalation.