Linux Kernel EUVD-2026-82004

Requires a pending PMSR (peer measurement / FTM ranging) request active on a P2P device or NAN interface at the moment that interface is stopped through cfg80211_stop_p2p_device() or cfg80211_stop_nan() - reachable via nl80211 commands, rfkill shutdown, or wireless_dev unregister. Exploitation is LIMITED by: local access only (AV:L); CAP_NET_ADMIN-level wireless configuration privilege (PR:L); a race/ordering window between subinterface removal and request cleanup (AC:H in practice); the presence of a driver/hardware supporting PMSR plus P2P or NAN; and affected kernels from ~5.0 up to the fixed 6.18.52 / 7.2.6 / 7.3-rc1 builds. It is not remotely reachable and not triggerable by attacker-supplied network data - it is a self-teardown ordering defect.

This is a mislabeled, moderate-severity local reliability/DoS bug, not the high-impact info-disclosure the vendor scoring and tags imply. The vendor CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) overstates confidentiality and integrity: the root cause is an ordering defect where cfg80211_stop_p2p_device() and cfg80211_stop_nan() fail to abort a pending PMSR (peer measurement) request before removing the mac80211 subinterface, leaving the lower driver holding a stale request it later dereferences when reporting a result - a use-after-free/stale-pointer condition whose primary observable outcome is a kernel crash (DoS), not data theft or code execution. The C:H/I:H claim is not supported by the description, which does not describe controlled leakage or corruption. The condition is a race/ordering window (AC should be H, not L) and is triggered by a teardown path (nl80211 command, rfkill shutdown, or wdev unregister) rather than by attacker-supplied data, so it is not straightforwardly attacker-driven. EPSS is not provided, there is no CISA KEV listing, and no public exploit is referenced - all consistent with a low real-world exploitation likelihood. Net: real but low-priority; my independent estimate is ~4.5, well below the vendor's 7.8. No conflicting network-vs-local signal exists - both CVSS and description agree the vector is local.

A local user or process with wireless-configuration capability (CAP_NET_ADMIN) initiates a peer measurement (PMSR/FTM ranging) request on a P2P or NAN interface, then tears that interface down (via nl80211, or by triggering rfkill) while the measurement is still pending, winning a narrow race so the subinterface is removed before the request is aborted. The driver retains the freed request and later dereferences it when reporting a result, crashing the kernel. No public exploit is identified at time of analysis; reliable triggering requires hitting the ordering window.