The bug occurs in the Linux kernel goldfish power supply driver. A race between IRQ registration and power_supply registration can trigger an interrupt handler after the power_supply handle has been freed, causing power_supply_changed() to access freed memory. This usually results in a kernel crash or silent memory corruption. The weakness is a use‑after‑free race condition.

The flaw affects any Linux kernel that includes the goldfish power supply driver. No specific kernel version range is supplied; systems running kernel images containing the driver are potentially vulnerable. The affected product is the Linux kernel power supply subsystem.

The EPSS metric is not available and the vulnerability is not listed in the CISA KEV catalog, yet the nature of the bug—an unprotected use‑after‑free in a privileged kernel function—means an attacker with physical or local code execution on a device using goldfish power supply could trigger a denial of service or potentially leverage memory corruption for escalation. The attack likely requires local interaction with the hardware that can trigger interrupts during driver removal or initialization, so the vector is inferred to be local or hardware.