The Linux kernel's s390/vfio_ccw driver initializes two workqueues, io_work and crw_work, during device setup but does not properly remove them when the driver’s private data structure is freed. As a result, if work remains queued when the structure is released, the kernel may dispatch work that references freed memory. This creates a use‑after‑free condition that can corrupt memory or cause a system crash. The vulnerability originates from omitted cleanup code during the driver’s development.

All installations of the Linux kernel that include the s390/vfio_ccw driver and have not applied the introduced cleanup change. The impact applies to any kernel version or build that still contains the unpatched workqueue initialization logic, regardless of sub‑revision. No specific version numbers are listed, so any unpatched kernel that uses this driver is potentially affected.

The CVSS score is 8.8, and the EPSS score is 0.00128 (less than 1%); the vulnerability is not listed in the CISA KEV catalog. The flaw requires an ability to trigger the device’s release path while pending work items exist, but the impact is limited to memory corruption or a crash. There is no evidence of a practical exploitation path to arbitrary code execution. The overall risk justifies timely remediation, though the likelihood of exploitation remains uncertain.