A use‑after‑free bug was found in the Linux mac80211 Wi‑Fi driver, where the mesh_fast_tx_cache path deletion process could leave a stale pointer in the cache after freeing the path. If an attacker can influence the timing of a lookup that holds the path, the cache may be updated with a reference to already freed memory, potentially leading to a kernel crash or code execution. The fix adds a deletion flag and guards the cache update under the walk lock, preventing the stale reference.

All Linux kernel builds that include the mac80211 Wi‑Fi driver with mesh support, prior to the application of the patch in this commit. No specific version range is listed, but any kernel that has not been updated to the latest stable releases must be considered vulnerable.

Use‑after‑free vulnerabilities in the kernel are high‑risk; they can be exploited to escape to kernel mode and gain root access. This particular flaw has no publicly available exploit yet, and its EPSS score is not published. Furthermore, it is not listed in the CISA KEV catalog, so while the likelihood of exploitation is uncertain, the potential impact is severe if an attacker can trigger the condition via crafted Wi‑Fi mesh traffic.