A mismatch between the device identifier used when requesting MSI-X IRQs and the one used when freeing them can leave an IRQ action registered with an incorrect identifier. If the IRQ handler remains active after the associated device structure has been freed, an interrupt may trigger a use-after-free or cause a kernel crash. The flaw is classified as a use-after-free vulnerability.

The issue appears in Linux kernel releases 6.19 in all release‑candidate builds and in kernel 6.9. Any system running one of these kernel versions, including development branches and early releases, is potentially impacted.

With a CVSS score of 7 the potential impact is high, but the EPSS score of less than 1 % and absence from the KEV catalog suggest a low likelihood of widespread exploitation. A local or privileged adversary that can trigger the faulty IRQ rollback path could cause a denial of service by crashing the kernel. The vulnerability is unlikely to be remotely exploitable without prior access to the affected system.