A race condition between module removal and pending work in the atmel‑mci driver allows a use‑after‑free. The kernel frees the host structure during module unload while background work may still be scheduled or executing, causing the work function to reference deallocated memory. This bug can crash the kernel or, if the attacker can control the freed memory contents, lead to arbitrary code execution within the kernel’s privilege level. The primary impact is the loss of system stability, potential privilege escalation, and data corruption. The weakness is a classic use‑after‑free vulnerability.

All Linux kernel versions that include the atmel‑mci driver before the patch commit. The affected package is the Linux kernel itself; no specific distribution versions or kernel releases are listed in the vendor data but any build that compiles the atmel‑mci module could be susceptible.

The CVE does not list an EPSS score or KEV status, and no CVSS score is provided in the data. The vulnerability requires local kernel access to exploit, which is typically limited to privileged users or systems where the driver can be loaded. This limits the likelihood of remote exploitation but still poses a significant risk for systems that allow local users to load or unload the driver. The exploitation path involves triggering the race by unloading the driver while an interrupt or timer is pending or queued. Because the flaw resides in kernel code, any successful exploitation would provide high privilege and potentially full control of the affected system.