The Linux kernel gigabyte_waterforce driver incorrectly stops device IO after stopping the HID hardware. This oversight creates a race condition between the device input report and the probe function when a probe fails after IO start, resulting in a use‑after‑free vulnerability that could be leveraged to execute arbitrary code in kernel mode or crash the system. The weakness stems from improper ordering of API calls, identified as a kernel race condition leading to a use‑after‑free flaw (CWE-825).

Linux kernel versions that contain the gigabyte_waterforce driver prior to the patch contain this flaw. The vulnerability applies to all releases of the Linux kernel that ship the vulnerable driver, regardless of the distribution, as the CPE indicates the kernel itself. No specific vendor or product version has been isolated, so any system running an affected kernel may be impacted.

The EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild, and the flaw is not listed in the CISA KEV catalog. The CVSS score of 5.5 indicates moderate severity, reflecting the race condition that could lead to a use‑after‑free. Nevertheless, the use‑after‑free can enable local privilege escalation or denial of service once the race is triggered. The usual attack vector would require the ability to manipulate the device probe sequence, such as a privileged user or during kernel boot, making it harder for remote attackers. Updating to a kernel release that includes the fix is the highest priority action to mitigate the risk.