The vulnerability is a use‑after‑free race condition in the Linux kernel’s ab8500 power supply driver. During removal or probe, the IRQ handler can be triggered after the power_supply handle has been freed or before it is initialized, causing power_supply_changed() to operate on invalid memory. This flaw can lead to a system crash or hidden memory corruption. The weakness is a classic use‑after‑free, aligning with CWE‑416. While an attacker would need access to trigger the race, the resulting denial of service or potential escalation makes it a serious flaw.

The flaw affects all Linux kernel builds that include the ab8500 power supply driver. No specific kernel version list is given in the data, but the issue is introduced by commit 1c1f13a006ed and fixed in subsequent commits. Devices that rely on the ab8500 battery charger controller are therefore impacted.

No CVSS or EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, indicating no publicly known exploitation at the time of writing. The risk remains high for denial of service: a local or privileged attacker could intentionally trigger an interrupt during device removal or initialization to crash the system. The lack of a known exploit suggests moderate to high likelihood of use within a trusted environment rather than widespread remote exploitation.