A use‑after‑free occurs when the ISM interrupt handler is still active while the device is being removed. The freed sba and ieq structures are accessed again, which can corrupt kernel memory, cause a crash, or lead to privilege escalation. The vulnerability is a classic use‑after‑free flaw.

The issue affects the Linux kernel’s s390/ism driver. No specific kernel versions are listed, but any version prior to the commit that introduced the free_irq() drain before freeing the data structures is vulnerable.

With a CVSS score of 8.4, the vulnerability is considered high severity. The EPSS score of less than 1% implies a low likelihood of exploitation, and the vulnerability is not currently listed in the CISA KEV catalog. Because the flaw resides in kernel code, the attack vector is likely local privilege escalation or a locally privileged user triggering a crash. The lack of publicly available exploit data suggests the threat is moderate until a reliable exploit emerges.