The vulnerability is a use‑after‑free race condition in the Linux kernel’s ab8500 power supply driver. During removal or probe, the IRQ handler can be triggered after the power_supply handle has been freed or before it is initialized, causing power_supply_changed() to operate on invalid memory. This flaw can lead to a system crash or hidden memory corruption. The weakness is a classic use‑after‑free, and the improper ordering of resource lifecycle operations reflect CWE‑364.

The flaw affects all Linux kernel builds that include the ab8500 power supply driver. No specific kernel version list is given in the data, but the issue is introduced by commit 1c1f13a006ed and fixed in subsequent commits. Devices that rely on the ab8500 battery charger controller are therefore impacted.

The CVSS score of 7.8 indicates high severity, but the EPSS score of <1% indicates a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, indicating no known public exploits. Based on the description, the flaw could be leveraged by a local or privileged attacker who can trigger a power supply interrupt during device removal or initialization, which could result in a kernel crash or memory corruption. The overall risk is therefore a potential local denial of service but without evidence of widespread or remote exploitation.