An unlocked race condition during device driver probing allows the bus match() callback to access the driver_override field without holding the device lock, resulting in a use‑after‑free. The resulting kernel memory corruption could crash the system or, if an attacker can control memory contents, lead to arbitrary code execution with kernel privileges.

All Linux kernel releases that have not incorporated the commit replacing the direct driver_override access with the driver‑core infrastructure. The vulnerability affects every Linux distribution that ships the older kernel code, with no specific version range listed in the advisory.

The CVSS score of 7.8 and an EPSS of less than 1% indicate severe potential impact but a very low likelihood of exploitation. Because the flaw depends on a timing race during bus probing, it is most likely exploitable only from a local context that can trigger or influence device attachments. The vulnerability is not listed in CISA KEV. No remote exploitation path is documented.