The Renesas USBHS driver in the Linux kernel contains a use‑after‑free flaw (CWE‑364) that is triggered while a USB device is being removed. During removal the driver frees its internal resources, including the pipe array, but the interrupt handler remains registered. When an interrupt fires after the resources have been deallocated but before the driver is fully unbound, the ISR may read or write memory that has already been freed, corrupting kernel memory and potentially causing a kernel panic. This type of weakness is a classic resource‑management error that allows an attacker to influence the state of the system in a harmful way.

All Linux kernel builds that include the Renesas USBHS driver are affected until the patch that calls devm_free_irq() before freeing resources is applied. The flaw is confined to kernel space and affects only systems running a kernel with this driver, regardless of the specific Linux distribution.

The vulnerability is not listed in the CISA KEV catalog, and no EPSS score is available, so the likelihood of exploitation is uncertain. Based on the description, the attack vector is inferred to be local; an attacker with access to a USB port can trigger a device removal while the driver is active. The use‑after‑free can corrupt kernel memory, posing a significant risk to availability and integrity of the host, but without an assigned CVSS score the nominal severity remains unclear.