This vulnerability is a use‑after‑free in the fsl‑mc driver’s driver_override_show() function. The show routine reads the driver_override string without holding the device_lock, while the store routine may free the string under the lock. A concurrent request can therefore trigger a use‑after‑free, corrupting kernel memory, crashing the system, or, in the worst case, enabling arbitrary code execution.

All Linux kernel installations that include the fsl‑mc driver are potentially affected. No specific kernel version range is listed, so any build containing the vulnerable code path should apply the patch when available.

The CVSS score of 7.8 reflects a high‑moderate severity with a low exploit probability (EPSS < 1%). The vulnerability is not listed in CISA’s KEV catalog. The attack vector is likely local privileged access to the fsl‑mc driver interface, where an attacker can trigger the store and show operations concurrently to exploit the use‑after‑free.