During the removal of the Rockchip GPIO driver, generic IRQ chips allocated by irq_alloc_domain_generic_chips() are not freed because the domain flags lack IRQ_DOMAIN_FLAG_DESTROY_GC. This causes the domain generic chip structure and its associated generic chips to leak, remaining registered on the global gc_list. Subsequent suspend, resume, or shutdown callbacks may access these leaked objects, potentially triggering a use‑after‑free that results in a kernel crash.

The vulnerability affects the Linux kernel’s Rockchip GPIO driver. Any system running a Linux kernel that incorporates this driver and performs a removal or hot‑plug operation could be impacted. The CVE data does not specify affected kernel versions, so the issue may exist in multiple releases that contain the unchanged driver code.

The CVSS score of 5.5 indicates medium severity, primarily due to loss of system integrity via kernel crash. The EPSS score signals a very low exploitation probability (< 1%). This vulnerability is not listed in the CISA KEV catalog, and no publicly disclosed exploits are available. Exploitation would require local privileged access to trigger the removal path for the Rockchip GPIO driver; the likely attack vector is through device removal during normal operation or by malicious hot‑plug.