The vulnerability resides in the Linux kernel’s MEI bus cleanup routine, where the cleanup of device queues and file lists occurs without holding the required device lock. This race condition can trigger a use‑after‑free if the bus is released while another thread still accesses its data, potentially corrupting kernel memory or causing a crash. An attacker with sufficient local access could exploit this flaw to gain higher privileges or disrupt system service by leveraging the corrupted kernel state.

All versions of the Linux kernel implementing the mei_cl_bus_dev_release routine are affected until the corresponding patch is applied. The specific kernel versions are not enumerated in the available data, but the issue is present in all unpatched kernel releases that include the unspecified code path.

The CVSS score is 7.0, indicating a high‑severity flaw due to the use‑after‑free in kernel space. The EPSS score of < 1% indicates a very low but non‑zero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, suggesting it may not yet be actively exploited in the wild. The likely attack vector is local, requiring an attacker to invoke or trigger the MEI bus cleanup during a race condition. However, due to the lack of publicly documented exploitation techniques, the risk remains elevated if the system processes privileged MEI devices.