This is a race condition in the Linux as102 USB character device driver that can trigger a use‑after‑free followed by a double‑free when the device is deregistered while file descriptors are still open. The flaw arises because the driver frees the device structure immediately after a failed deregistration path, even though the device node may still be referenced by user‑space handles. If a user opens the device between registration and deregistration, the subsequent close invokes the same deallocation, corrupting kernel memory. According to the CWE identifiers, this is a use‑after‑free (CWE‑416) and a double‑free (CWE‑364).

The vulnerability applies to all Linux kernel builds that contain the as102 USB driver before the patch that changes the deallocation logic. The affected vendor is Linux Kernel, and all distributions based on it are impacted until they incorporate the upstream commit referenced in the advisory. No specific kernel version is listed; therefore any kernel that has not merged the documented fix remains vulnerable.

The CVSS score of 7.8 indicates a high impact for a local attacker with sufficient privileges or access to the USB device. The EPSS score of <1% suggests exploit attempts are currently rare, and the vulnerability is not yet listed in CISA’s KEV catalog. The likely attack vector is a race condition triggered by inserting and removing the USB device while a local user has an open file descriptor on the device, which would result in memory corruption once the device is finally released. While the attack requires a local or privileged context and a specific race condition, the presence of the flaw warrants timely remediation.