A double free vulnerability in the Linux kernel mac80211 subsystem may allow a local authenticated attacker to trigger kernel memory corruption and achieve system instability or privilege escalation.

This is a double free vulnerability (CWE-415) occurring within the ieee80211_set_fils_discovery function. The flaw is triggered when memory allocation fails, causing the kernel to attempt to free an object that has already been queued for destruction, requiring local access with low privileges.

The vulnerability carries a CVSS score of 7.8, indicating a high severity risk. Successful exploitation could lead to a local denial of service via kernel panic or potential code execution scenarios, compromising the integrity and availability of the affected system. Organizations relying on Linux kernel environments for critical infrastructure should treat this as a priority to prevent unauthorized system modification.

Immediate Action: Update the Linux kernel to version 6.12.101, 6.18.42, 7.1.6, or a later stable release where the fix is integrated.

Proactive Monitoring: Monitor system logs for kernel panics or KASAN output related to memory management and RCU operations.

Compensating Controls: Restrict local access to the affected hardware and ensure that only authorized users have the permissions necessary to interact with wireless networking configurations.

Public Exploit Available: Unknown.

Given the high CVSS severity and the potential for kernel-level impact, administrators should prioritize patching the Linux kernel across all production environments. While the exploit requires local access and specific failure conditions, the risk of system compromise warrants immediate attention to prevent potential exploitation of this memory management flaw.