The Linux kernel’s driver_match_device() function is sometimes invoked without holding the required device_lock, creating an inconsistent lock state across three call sites. This flaw allows a race condition that can evolve into a use‑after‑free, specifically when the driver_override mechanism relies on that lock. The resulting use‑after‑free is a weakness defined by CWE‑413 and CWE‑416, and it enables an attacker who can trigger the race locally to execute arbitrary code within the kernel address space, potentially achieving full system compromise.

Any Linux kernel distribution that has not incorporated the commit adding driver_match_device_locked() is vulnerable. The vendor list is generic "Linux:Linux", indicating that all standard Linux kernel releases before the patch are affected. No specific version range is supplied, so the vulnerability applies to every pre‑patch kernel regardless of distribution.

With a CVSS score of 7.8 the vulnerability is rated high severity, and its EPSS score is very low (<1%), indicating a low likelihood of exploitation that has not yet been observed in the wild. Exploitation would most likely occur locally, requiring an attacker able to load a bus driver that depends on driver_override and trigger the race condition in driver_match_device(). The fix eliminates the race by ensuring the lock is always held for every call, thereby removing the potential for the use‑after‑free. Until the kernel is updated, the risk remains significant for systems that load vulnerable drivers.