In the Linux kernel driver for the CH341 USB‑to‑SPI interface, the probe routine does not properly clean up when a failure occurs; the controller remains registered, pins stay enabled, and the receive URB is not freed. This omission creates a use‑after‑free and memory‑leak condition that could corrupt kernel memory and potentially allow privileged code execution.

This flaw is present in every Linux kernel that ships the CH341 driver without the recent commit references. Because the commit URLs are included, users can determine whether their kernel includes the fix. No explicit version range is given, so any system that has not incorporated those commits is considered affected.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but the lack of a mitigated path keeps risk significant. The attack vector is inferred from the description: an attacker would need to supply a CH341 USB device that triggers the probe failure path, meaning local or device‑injection access is likely required. If executed, the resulting use‑after‑free could allow a local attacker to gain kernel‑level code execution.