The iowarrior USB driver in the Linux kernel contains a race condition that causes a use‑after‑free when the driver’s release path races with a device disconnect. The mutex unlocking code can still reference the freed memory, leading to memory corruption. An attacker that can trigger a USB disconnect while the driver is being released may force a kernel crash, potentially allowing escalation or denial of service.

All Linux kernels that lack commit 3c0a7b29ebb391d5f50b115e86f842b709195b08 are affected. Vulnerable versions include kernel 2.6.21 rc1 through rc7, 7.2 rc1, 7.2 rc2, and any generic Linux kernels that have not yet incorporated the fix. The patch replaces the mutex unlocking with a reference counter (kref).

The CVSS score of 7.8 indicates moderate‑to‑high severity. EPSS is reported as < 1%, showing a very low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local user or process that can insert or remove a USB device to trigger the race. While no publicly documented exploit exists, the crash risk warrants prompt patching.