Based on the description, a race condition in the WiFi mac80211 subsystem allows a station teardown to proceed without fully cancelling pending Power‑Save delivery work. The worker checks a station‑alive flag before delivering frames, but the flag and driver reference may be cleared while the worker is still running. If the task continues, it can access invalid data structures or attempt to transmit on a no‑longer‑existing interface, resulting in kernel memory corruption and a potential crash. This represents a significant reliability and availability threat that could be leveraged for denial of service if an attacker can force station removal events. Based on the description, it is inferred that an attacker could trigger such events, potentially via local or remote control of WiFi interfaces.

The flaw afflicts the generic Linux kernel, specifically the mac80211 WiFi subsystem in any build that has not incorporated the patch commit d34ba2168a3c. All Linux kernel releases prior to this commit are vulnerable, regardless of distribution or vendor. The issue is inherent to the core WiFi drivers and is not limited to a particular distribution or version numbering, though the fix is available in newer kernel releases that include the commit.

The CVSS score is 5.3, indicating a medium severity vulnerability, and the EPSS score is less than 1%, suggesting a low likelihood of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to trigger station teardown events such as disconnecting an AP or mesh node while the system is under load, and the attack vector could be local or remote depending on WiFi configuration. Given the potential for kernel panic, the risk remains significant for affected systems, even though public exploitation data are limited. Prompt application of the kernel patch is strongly recommended.