The kernel driver topcliff‑pch had a use‑after‑free bug that could trigger during the unbind operation. The bug allowed the driver to release DMA buffers before its internal queue had fully flushed, potentially leaving dangling pointers that a subsequent memory allocation could reuse. This race can corrupt kernel memory, leading to a crash or, in the worst case, potentially allowing local code execution with kernel privileges; the extent of this consequence is inferred from the nature of the fault.

The flaw exists in the Linux kernel’s topcliff‑pch driver. Any kernel version that includes this driver and does not contain the fix is vulnerable. The specific kernel release dates are not stated, so all current kernels missing the patch are affected until the update is applied.

The CVSS score is not supplied and the EPSS score is unavailable, so the numerical risk cannot be quantified. Because the vulnerability is triggered during driver unbind, it likely requires privileged access to perform the operation, a conclusion inferred from the need for driver management privileges. No public exploits are listed and the issue is not in the CISA KEV catalog. Nevertheless, the bug can lead to denial of service or privilege escalation if an attacker gains sufficient local access; this possibility is inferred from the potential kernel memory corruption.