A use‑after‑free flaw exists in the Linux kernel’s mac80211 stack when an RX BA session is torn down. The session timer may be queued on a freed tid_rx structure, and subsequent timer‑wheel processing or the callback can dereference this freed memory. This dangling reply can lead to kernel memory corruption, potential crash, or a vector for arbitrary code execution if an attacker can trigger the condition.

Any Linux kernel installation where the mac80211 driver has not yet integrated the timer_shutdown_sync patch is vulnerable. The admission of both generic Linux distribution kernels and the upstream kernel product means that all unpatched systems that handle Wi‑Fi traffic, regardless of distribution, are at risk.

The CVSS score of 5.3 indicates moderate severity overall. The EPSS score of <1% reflects a very low exploitation probability in the wild at present, and the vulnerability is not currently listed in CISA’s KEV catalog. Based on the description, it is inferred that the flaw can be triggered remotely by an attacker who can send crafted Wi‑Fi frames and force an RX BA session teardown, which could in turn allow the dangling timer to execute and potentially cause a kernel crash or code execution, though prevailing data suggests a low‑to‑moderate practical risk.