A defect in the Linux kernel’s Multi‑Function Device subsystem for Chrome OS devices causes the driver data pointer to be bound to a platform device before the device initialization routine has finished successfully. If the initial probe fails, the device structure is freed while the driver data remains registered, allowing a sub‑driver to read a stale pointer. This creates a use‑after‑free that could allow a sub‑driver to access freed memory. The vulnerability may result in undefined behavior such as memory corruption or a kernel crash.

The vulnerability affects Linux kernel systems that load the Chrome OS cros_ec and cros_ec_typec kernel modules during boot or module load. Any Linux installation that includes the cros_ec, cros_ec_typec or related Chrome OS kernel drivers is potentially vulnerable until the patch that defers dev_set_drvdata is applied. There is no specific vendor version list available; the issue applies to kernel builds that include the affected code paths.

The CVSS score of 7 indicates high severity. EPSS indicates a probability of exploitation below 1%, and the vulnerability is not listed in the CISA KEV catalog, meaning no publicly documented exploits are known. The vulnerability requires local access to trigger probe failures or manipulate the device initialization sequence and is not trivially exploitable remotely. A local attacker who can induce repeated probe failures may trigger the use‑after‑free, potentially leading to denial of service or kernel memory corruption.