The vulnerability is a use‑after‑free in the at91 watchdog driver. While the timer callback is running, the driver can be torn down without waiting for the callback to finish. The callback can still rearm the watchdog timer; however, timer_delete() does not block or prevent this. This results in the callback accessing freed device memory, which can corrupt kernel memory and potentially crash the system or be leveraged for privilege escalation.

All systems running a Linux kernel that includes the at91sam9_wdt driver without the patch. The driver is used on AT91 series hardware; any system that supports this hardware and has not yet applied the fix is affected.

The CVSS score of 7.8 indicates a significant risk. The EPSS score is below 1%, suggesting exploit probability is currently low, but the flaw occurs in privileged kernel code. The vulnerability is not listed in CISA KEV. Exploitation requires triggering driver removal or a probe failure; the advisory does not state that higher privileges are needed, but the impact would affect the entire system.