A defect in the Linux kernel’s Multi‑Function Device subsystem for Chrome OS devices causes the driver data pointer to be bound to a platform device before the device initialization routine has finished successfully. If the initial probe fails, the device is freed while the driver data remains registered, allowing a sub‑driver to read a stale pointer. This creates a use‑after‑free that can lead to an arbitrary kernel read or write and potentially allow an attacker to execute code with kernel privileges or crash the kernel, resulting in loss of confidentiality, integrity, and availability.

The fault is confined to Linux systems that load the cros_ec, cros_ec_typec and related Chrome OS sub‑drivers during boot. Any system that utilizes the Linux kernel and installs these kernel modules is potentially vulnerable until the patch that delays dev_set_drvdata is applied.

EPSS indicates a probability of exploitation below 1% and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widely known public exploits. The weakness requires local access to trigger probe failures or manipulate the device initialization sequence, and therefore is not exploitable remotely. A local attacker who can induce repeated probe failures may trigger the use‑after‑free, leading to denial of service or privilege escalation within the kernel.