A use‑after‑free condition arises in the Linux kernel’s USB Type‑C UCSI CCG subsystem when a device is removed. The removal path frees the ucsi object before releasing the interrupt line, allowing an in‑flight IRQ handler to access the freed pointer and corrupt kernel memory or trigger a crash, potentially leading to a kernel panic or denial of service.

All Linux kernel releases that include the UCSI CCG module without the mitigation are affected. The patch was applied in later kernel commits, so any kernel version deployed before those commits remains at risk. Specific legacy kernel versions are not enumerated in the data but all affected kernel releases prior to the patch are vulnerable.

The EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation. Because the flaw is a kernel‑level use‑after‑free, a local user who can trigger device removal or hotplug events can potentially cause a crash and a denial of service. The likely attack vector is a local user or process that can physically remove a Type‑C device or programmatically initiate a removal sequence.