The Linux kernel mac802154 subsystem had a flaw where interface removal used list_del() in the bulk hardware teardown path, causing potential use-after-free scenarios when asynchronous transmit completions accessed a poisoned list node in ieee802154_wake_queue(). The fix involved replacing list_del() with list_del_rcu() to safely remove interfaces under RCU protection, and relying on unregister_netdevice() to handle synchronization with in-flight RCU readers without additional grace-period waits.

This vulnerability could lead to use-after-free conditions in the kernel, potentially causing kernel crashes or undefined behavior. No specific exploitation details or impacts such as privilege escalation or remote code execution are provided.

A fix has been implemented in the Linux kernel to address this issue by using list_del_rcu() for interface removal and ensuring proper synchronization with unregister_netdevice(). Users should apply the official kernel updates containing this fix. Patch status is not explicitly confirmed in the provided data; check the vendor advisory or Linux kernel mailing lists for the exact fixed versions and update accordingly.