In the Linux kernel's gpio aggregator subsystem, an error path frees a memory pointer (aggr->lookups->dev_id) before removing the related entry from the lookup table. If another thread calls gpiod_find() before the entry is removed, it may traverse the list and invoke gpiod_match_lookup_table(), which blindly dereferences dev_id during a strcmp() call. This sequence causes a use‑after‑free, leading to kernel memory corruption, and potentially arbitrary kernel code execution or a system crash. The weakness is marked as CWE‑416 (Use After Free) and CWE‑825 (Uncontrolled Memory Allocation).

Affected systems are any machine running a Linux kernel that has not yet incorporated the commit that reverses the cleanup order. The CVE references include kernel releases 7.1 rc1 through rc4 and all other Linux kernels, indicating the issue existed prior to those releases. Therefore, any Linux distribution shipping a kernel version older than the commit is potentially vulnerable. The vulnerability is limited to the kernel component; no direct impact on user‑space applications is described.

The CVSS score of 7.8 reflects a high severity. The EPSS score of < 1 % indicates exploitation is considered unlikely at the current time, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is local, requiring an attacker or compromised process to trigger the race condition between gpiod_find() and the error‑cleanup path by performing concurrent operations. Remote exploitation or network‑based attack is not indicated. The risk is that a successful exploit could corrupt kernel memory, potentially enabling privilege escalation or a denial‑of‑service if the kernel crashes.