In the Linux kernel gpio aggregator subsystem, an error path frees a memory pointer (aggr->lookups->dev_id) before it removes the corresponding entry from the lookup table. If a concurrent thread calls gpiod_find() in the narrow window before the removal, it may traverse the list and call gpiod_match_lookup_table(), which unconditionally dereferences dev_id. This results in a use‑after‑free (CWE‑825) that can corrupt kernel memory, potentially leading to code execution or a system crash. The vulnerability was addressed by reversing the order of cleanup so that the entry is removed prior to freeing dev_id.

Affected vendors and products are any Linux distributions that ship with an unpatched Linux kernel containing the vulnerable gpio aggregator code. No explicit version range is listed in the CVE record, so any kernel build that has not yet incorporated the commit that fixes the use‑after‑free is considered vulnerable. The impact is limited to the kernel component and not to user‑space applications directly.

The CVSS score of 7.8 reflects a high severity, while the EPSS score of < 1 % indicates that exploitation is considered unlikely at this time. The vulnerability is not listed in the CISA KEV catalogue. The likely attack path requires a local user or compromised process to trigger the race condition between gpiod_find() and the cleanup logic; remote exploitation or network interaction is not required. Because it relies on timing between concurrent operations, devising a reliable exploit is non‑trivial, but kernel memory corruption could grant arbitrary code execution or a denial‑of‑service condition if successfully triggered.