The mmc: vub300 driver in the Linux kernel contains a use‑after‑free bug that can trigger during controller disconnect or driver unbind. The flaw stems from device‑managed allocation of the controller and an incorrect lifetime tied to the parent USB device rather than the interface, potentially leaving a dangling pointer. This use‑after‑free maps to CWE‑416 and the lifetime mishandling can lead to memory leaks (CWE‑911). An attacker could exploit the freed memory to corrupt kernel state, leading to a crash or possible escalation. The CVSS score of 7.8 highlights the high severity of this issue.

Linux kernel versions 6.17 and all 7.0 release candidates (rc1 through rc7) that load the vub300 driver are impacted. Any system that plugs a USB device supported by this driver while the kernel versions above are in use is vulnerable.

The EPSS score is less than 1%, indicating a very low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is most likely local: an attacker must trigger a disconnect or unbind operation on a device using the vub300 driver to provoke the use‑after‑free. Successful exploitation would result in kernel memory corruption or a denial of service. Because the flaw is a classic use‑after‑free (CWE‑416) with additional lifetime mismanagement (CWE‑911), exploitation would require careful timing but could lead to privilege escalation if kernel memory is corrupted.