The flaw arises when the hwmon corsair-cpro driver fails to stop device IO before calling hid_hw_stop. This ordering error creates a race condition between hid_input_report and the code that executes immediately after hid_device_io_start during the driver probe. The race can lead to a use‑after‑free (CWE‑825), allowing an attacker to corrupt kernel memory and potentially execute arbitrary code in kernel context.

All Linux kernels that include the hwmon corsair‑cpro driver prior to the recent fix are affected. The vulnerability exists in any distribution whose kernel contains this driver while the patch has not been applied. No specific kernel version ranges were listed, so any system running an older kernel with the driver is at risk if upgrades are not performed.

The CVSS score of 4.1 indicates medium severity, and the EPSS score of < 1 % shows a very low predicted exploitation probability. The flaw is not recorded in CISA KEV. Based on the description, it is inferred that the attack vector would require local or privileged access to trigger the race by inducing a probe failure, making remote exploitation unlikely. The primary threat therefore comes from local users or processes that can load or interact with the driver.