In the Linux kernel, a bug in the wifi cfg80211 subsystem can cause the same beacon IE data to be owned by two separate entries when processing hidden‑group probe responses during a channel switch. The kernel copies a pointer to the beacon IEs from the group entry into the probe‑response entry, meaning that freeing the group entry later also frees the data used by the probe‑response entry. When both entries are eventually destroyed, the shared memory region is freed twice, producing a use‑after‑free condition. Based on the description, it is inferred that an attacker who can influence hidden‑group traffic association may trigger this double free, potentially leading to arbitrary memory corruption or kernel code execution.

All Linux kernel implementations that include the cfg80211 Wi‑Fi stack are affected, as the issue is present in the kernel source itself. The reported fix applies to every kernel version that incorporates the patch commit referenced in the advisory; the input does not list specific version ranges, so any kernel prior to the patch is potentially vulnerable.

The CVSS score of 5.3 indicates a moderate impact, and the EPSS score is reported as < 1%, suggesting that active exploitation is unlikely at present. The vulnerability is a classic use‑after‑free in a privileged kernel module. The likely attack vector involves the device processing hidden‑group probe responses; based on the description, it is inferred that an attacker could attempt to trigger the flaw by creating a rogue Wi‑Fi access point or performing a crafted scan. If successful, the attacker could gain arbitrary execution in kernel mode, which would give them full control over the affected machine. No public exploit is listed in the CISA KEV, but the nature of the flaw makes it an attractive target for malicious actors.