A race condition in the Linux kernel media driver em28xx allows an attacker to trigger a use‑after‑free and a NULL pointer dereference. The vulnerability occurs when the kernel reads the device’s v4l2 structure without holding the necessary lock, while other code paths may free the structure and null the pointer. This race (CWE‑367) leads to a classic use‑after‑free flaw (CWE‑416). An attacker could exploit this to crash the kernel, leading to a denial‑of‑service condition.

All Linux kernel installations that include the em28xx media driver are affected. The driver is part of the mainstream kernel source; the exact kernel version numbers are not listed in the CVE data, but any kernel that still contains the pre‑fix code is vulnerable. Users running recent distributions that ship with an unpatched kernel are at risk.

The CVSS score of 7.8 indicates high severity, but the EPSS score of less than 1% shows that exploitation is unlikely at the moment. The vulnerability is not listed in the CISA KEV catalog, which means there are no publicly known active exploits. The likely attack vector is local or privileged access to a device managed by the em28xx driver, as the race requires manipulation of the kernel’s v4l2 device interfaces. Without an active exploit, the risk is primarily a potential for kernel panic and service disruption.