The vulnerability stems from the hwmon corsair-cpro driver not halting device IO before invoking hid_hw_stop. This oversight creates a race condition between hid_input_report and the post‑io start code path. If the probe fails after initiating IO, a use‑after‑free occurs, allowing an attacker to manipulate memory references.

Any Linux distribution whose kernel contains the hwmon corsair-cpro driver prior to the patch is affected. The flaw exists in all kernel releases where the driver is present and the fix has not yet been applied. Administrators should verify the kernel version and check for updates that include the corrected sequence of calls.

The issue is a classic use‑after‑free that can be leveraged by a local user or a privileged process to execute arbitrary code in kernel context. No public exploit or KEV listing exists yet; EPSS is not available, so risk assessment depends on local exploitation conditions. Upgrading to a patched kernel is the most effective mitigation.