The kernel change reveals that the helper v4l2_async_register_subdev_sensor() uses the macro __v4l2_async_register_subdev(sd,THIS_MODULE), causing this_module to refer to the v4l2‑fwnode module rather than the sensor driver that set sd->owner. When the helper is built‑in, THIS_MODULE resolves to NULL and overwrites the sensor driver’s owner field. As a result the sensor driver’s reference count is never incremented when the sub‑device is registered asynchronously. This allows the sensor device module to be unloaded while a notifier such as a CSI‑2 bridge still holds a reference to the sub‑device, leading to a use‑after‑free situation that can crash the kernel or trigger instability.

The affected product is the Linux kernel, specifically any build that includes the v4l2‑fwnode code and the v4l2_async_register_subdev_sensor() helper without the patch. No specific vendor or version list was supplied, so any kernel built from the point the vulnerable code existed until a newer version is installed is presumed affected.

The CVSS score is 5.5, and the EPSS score is < 1%. The vulnerability can cause the kernel to crash if an attacker or a misbehaving module unloads a sensor driver while its sub‑device remains in use. Because the flaw involves reference counting, it does not expose information directly but can lead to denial of service. The issue is not listed in CISA KEV. No public exploits have been reported as of the data provided. The likely attack vector is local and requires the ability to load or unload kernel modules. It is recommended to apply a kernel update that includes the fix or to avoid unloading sensor modules while sub‑devices remain active.