The iowarrior USB driver in the Linux kernel contains a race condition that can trigger a use‑after‑free in the mutex_unlock() path. If a device disconnect occurs concurrently with the driver’s release path, memory that has already been freed may be accessed. This kernel memory corruption can lead to a system crash. The vulnerability is mitigated by replacing the mutex approach with a reference count for driver data.

Any Linux kernel that includes the default iowarrior USB driver prior to the commit that added the kref solution is affected. No specific kernel version numbers were listed, so the fix is only present in code that incorporates the listed commit.

The CVSS score of 7.0 describes a moderate to high severity impact. The EPSS score is reported as <1 %, indicating low expected exploitation likelihood, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a local user or process that can cause a USB device to disconnect, triggering the race. Given the limited exploitation window and lack of publicly documented exploits, the risk to systems is moderate, but the potential for kernel crashes warrants timely patching.