In the Linux kernel, the driver attachment routine can access the driver_override field without holding the necessary device lock, creating a use‑after‑free condition during the bus match callback. This flaw is a typical use‑after‑free (CWE‑413) that can corrupt memory or trigger unintended execution paths if the driver structure is freed while still being referenced.

All Linux kernel releases that do not yet include the driver_override locking fix. The vulnerability affects platform drivers in the production kernel; the exact version range is not specified, so any system running a kernel prior to the patch is at risk.

The flaw can be exploited locally by triggering a device match during attachment, such as through a malicious device or automated device enumeration. The likely attack vector is local device interaction, allowing an attacker with physical or remote local access to induce the improper match(). The CVSS score of 7.8 indicates high severity, the EPSS score of < 1 % suggests a low exploitation probability at this time, and the vulnerability is not listed in CISA KEV. The lack of device lock protection during match() is the critical weakness, and an attacker with local access could use this to gain kernel privileges, making the risk moderate to high for exposed systems.