A memory corruption flaw in the Linux kernel mwifiex driver, triggered by interrupted synchronous command waits, poses a significant risk of system instability and potential local privilege escalation.

The mwifiex Wi-Fi driver fails to properly detach a data buffer when a synchronous command wait is interrupted. This allows the kernel to write firmware response data into a stale stack memory address, resulting in stack corruption and kernel panic.

Successful exploitation of this vulnerability allows a local attacker to cause a denial of service through a system crash. Furthermore, by carefully controlling the corrupted stack memory, there is a potential for local privilege escalation, which could lead to unauthorized system access and full compromise of the affected host. The CVSS score of 7.8 reflects the high severity of this local attack vector.

Immediate Action: Update the Linux kernel to version 6.12.109, 6.18.50, 7.2.4, or later to incorporate the necessary fix.

Proactive Monitoring: Monitor system logs for kernel panic events, stack trace errors, or unusual Wi-Fi driver behavior that may indicate attempts to trigger this race condition.

Compensating Controls: Restrict local shell access to untrusted users to mitigate the risk of a local attacker executing the exploit code on the target system.

Public Exploit Available: No

Given the potential for kernel-level memory corruption, organizations should prioritize updating their Linux kernel environments to the specified patched versions. Failure to address this vulnerability leaves systems susceptible to local denial of service and potential privilege escalation attacks.