During watchdog device unregistration the kernel fails to remove a previously registered power‑management notifier when the WDOG_NO_PING_ON_SUSPEND option is used. After this drop a suspend or resume event can invoke the notifier through a pointer that points to memory that has already been cleared, leading to a use‑after‑free condition. This can cause a kernel panic or, if an attacker can influence the wake‑up sequence, arbitrary code execution at the kernel level. The weakness aligns with CWE‑825.

Linux kernel installations that include the watchdog driver with the WDOG_NO_PING_ON_SUSPEND configuration before the fix are affected. The specific kernel versions are not listed, so any Linux system running an unpatched kernel is potentially vulnerable.

The CVSS score is 5.5, indicating a moderate severity. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. The use‑after‑free in the kernel suggests that exploitation is likely constrained to scenarios where an attacker has local privileges or can manipulate suspend/resume events. An attacker can trigger the window where the stale notifier is invoked by forcing a suspend or resume after the device has been unregistered, potentially leading to a crash or privilege escalation.