The vulnerability arises in the Linux kernel’s Wi‑Fi driver (mac80211) when the kernel prematurely frees an old channel context while a replacement context still retains a stale pointer to it. This premature free leaves the old context dangling, which can subsequently be accessed by later code paths that follow the stale replace_ctx pointer, resulting in a use‑after‑free condition. An attacker could exploit this to corrupt kernel memory or trigger a panic, leading to arbitrary code execution or denial of service.

All Linux kernel installations that include the mac80211 Wi‑Fi driver are potentially impacted, as the critical logic resides in core kernel code shared by routers, embedded devices, and other systems running a standard Linux kernel. No specific kernel version is listed, implying that the issue could exist in any kernel build prior to the commit that fixed it.

Because the vulnerability involves a use‑after‑free in kernel space, the potential impact is high if an attacker can trigger the faulty channel context transition. The EPSS score is < 1% and the vulnerability is not listed in CISA KEV, so the likelihood of exploitation is uncertain but could be significant in environments exposed to untrusted wireless traffic. The CVSS score of 4.7 indicates moderate severity, but the presence of a use‑after‑free in kernel code typically warrants attention.