The Linux kernel contains a flaw in the handling of a dynamic reset GPIO device. The device, which is intended to live in memory indefinitely, exposes sysfs bind attributes that allow user space to unbind it. If an attacker unbinds the device, the kernel dereferences freed memory, resulting in a use‑after‑free condition. This vulnerability can corrupt memory and may enable arbitrary code execution or a denial‑of‑service scenario. The weakness is a classic use‑after‑free.

All kernel releases prior to the patch that suppresses the reset GPIO device’s sysfs bind attributes are affected. The vulnerability is not limited to a specific vendor or version; any kernel that includes the unprotected bind attribute when the device is present is susceptible.

Exploitation requires the attacker to write to the sysfs bind attribute, which normally needs local user privileges with access to the device’s directory in /sys. The likely attack vector is inferred from the description of user‑space ability to unbind the device. The CVSS score is not published and the EPSS value is unavailable, but the vulnerability is not listed in the CISA KEV catalog. Consequently, the risk is confined to local users who can manipulate sysfs entries; remote exploitation remains unlikely without additional escalation vectors.