In the Linux kernel, a use‑after‑free bug was discovered in the fore200e ATM driver. When a PCA‑200E or SBA‑200E adapter is detached, the device structure is freed while an associated tasklet may still be scheduled or running. The tasklet then accesses the freed memory, leading to undefined behaviour. If an attacker can trigger the device removal while the tasklet is pending, they could potentially use the fault to alter kernel memory or crash the system, effectively allowing privilege escalation or denial of service.

The vulnerability affects all Linux kernel builds that include the fore200e driver for the PCA‑200E and SBA‑200E adapters. The specific kernel versions are not listed in the advisory, so any affected release prior to the fix may be impacted. Systems that employ the fore200e driver and allow dynamic removal of the hardware are at risk.

Although the CVSS score is not disclosed, use‑after‑free is a high‑severity flaw. Exploitation requires a local privileged user capable of removing the adapter while the kernel is processing I/O, making the attack vector a local user attack. The absence of an EPSS score suggests limited public exploitation data. The flaw is not listed in CISA’s KEV catalog, indicating no known active exploitation campaigns. Nevertheless, the potential for arbitrary code execution or system crash warrants rapid remediation.