The Linux chaoskey USB driver contains a use‑after‑free bug in its release routine. When a user closes the device file after the USB device has already been unplugged, the code attempts to log a usb_interface reference that has been freed. The fault occurs inside a debugging statement, so it does not provide direct privilege escalation or arbitrary code execution; instead it triggers a KASAN error and results in a kernel crash. The impact is thus limited to a denial of service via kernel panic, which can disrupt services and potentially provide a weak foothold for a local attacker if the crash can be leveraged further. This flaw is a classic memory‑corruption vulnerability (CWE‑825).

All Linux kernel builds that include the chaoskey driver before the commit that removes the offending debug statement are susceptible. This includes every distribution kernel version that has not yet integrated the change referenced in the bug tracker. No specific vendor or product version list is supplied, so any system running an unpatched kernel with this driver enabled is at risk.

The EPSS score is reported as less than 1 %, indicating very low observed exploitation activity. The vulnerability is not listed in CISA’s KEV catalog. The path to exploitation is local: an attacker must have a process with an open file descriptor to the chaoskey device while the USB device is being unplugged. Because the fault resides in a debug logging path, the attack window is narrow and the overall risk is moderate compared to more serious exploitation vectors. The CVSS score of 5.5 indicates a medium severity vulnerability under the current scoring methodology.