Linux Kernel EUVD-2026-55595

Requires WiFi 7 (802.11be) hardware with MLO (Multi-Link Operation) enabled and a kernel driver compiled with MLO support; the vulnerable percpu path is only active when uses_rss is set and pcpu_rx_stats is allocated. Attacker must be physically adjacent to the target WiFi network (AV:A). The race requires simultaneous link removal and concurrent RX packet processing across CPU cores with precise timing - the commit text explicitly states this race is 'hard to win in practice.' Limiting factors: WiFi 7 hardware is not yet widespread in enterprise or datacenter environments; the attack requires adjacency (no remote Internet exploitation); and the race window is narrow without a reliable heap spray or timing primitive. Systems running pre-WiFi-7 hardware, or kernels compiled without MLO support, are entirely unaffected.

The official CVSS 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) is likely overstated on the AC dimension. The kernel commit description explicitly states 'the race is hard to win in practice,' which better maps to AC:H than AC:L. EPSS at 0.17% (6th percentile) independently confirms very low observed exploitation probability. The vulnerability is not listed in CISA KEV and no POC exists. The AV:A metric is well-grounded: exploitation requires physical proximity to a WiFi 7 MLO-capable network. If the race were won, kernel-level C:H/I:H/A:H impact is realistic for a UAF in the interrupt-driven RX path. The net risk profile is: theoretically serious, practically difficult to exploit, with no real-world exploitation evidence. This is a correctness fix that should be applied in due course but does not warrant emergency response for most organizations. The CVSS AC:L in the official NVD vector conflicts with the description text - defenders should weight the description's own admission over the raw numeric score.

An attacker in physical proximity to a WiFi 7 MLO-capable network joins the network, establishes an MLO association, and then sends packets engineered to trigger a link removal event (such as causing a link to deauthenticate) precisely while the kernel's RX fast path is processing an incoming frame on another CPU core. If the race window is won, the kernel dereferences the already-freed percpu stats block, allowing a write to freed memory that could be leveraged for kernel heap corruption and eventual privilege escalation. No public exploit code exists, and the narrow race window makes practical exploitation extremely difficult without a highly refined and targeted approach.