In the tmp006 driver for the Linux kernel, the probe routine allocates a data‑ready trigger with devm_iio_trigger_alloc but registers it using iio_trigger_register. The driver has no .remove() callback, so when the module is unloaded the trigger remains in the global trigger list while its memory is freed by the device‑managed allocator, creating a dangling pointer. This resource‑management flaw, identified as CWE‑825, can lead to kernel instability or a panic, effectively denying service to the system.

The vulnerability affects any Linux kernel that includes the unpatched tmp006 temperature sensor driver in the Industrial I/O (IIO) subsystem. Because no specific kernel version is identified, any build containing the unpatched driver is potentially at risk.

The EPSS score of <1% indicates a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker with local root privileges who loads or unloads the tmp006 module, triggering the dangling entry and potentially causing a crash. Exploitation would require kernel‑level or local privileges; remote exploitation is unlikely without additional vectors. Even with the low EPSS probability, a kernel crash can lead to an unplanned reboot or data loss.