The flaw lies in the sloppy‑logic‑analyzer driver for Linux kernels; the debugfs interface’s write handler performs a write into a private data structure that is freed during device unbinding. The handler never acquires a debugfs reference and uses a hand‑rolled file creation that omits the necessary proxy wrapper. This allows a race condition where a root user writes to /sys/bus/platform/drivers/gpio-sloppy-logic-analyzer/unbind followed by a write to the "trigger" debugfs file, causing a use‑after‑free write into freed kernel memory. The resulting memory corruption can be abused by a privileged attacker to corrupt kernel objects or execute arbitrary code. The description confirms this via KASAN traces and a reproducible exploit.

All Linux kernel versions that include the sloppy‑logic‑analyzer driver before the patch that replaces debugfs_create_file_unsafe() with the safe debugfs_create_file(). No specific version numbers are given, so any kernel released prior to the corresponding commit should be regarded as affected.

The defect is local and requires root or an equivalently privileged user because the attacker must write to the platform driver’s unbind file. The use‑after‑free enables memory corruption and potentially arbitrary code execution within the kernel. The CVSS score of 5.5 reflects moderate seriousness, and the EPSS score is <1%, indicating a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The attack can be performed by any local attacker with root rights, but remote exploitation would not be possible without additional code‑execution paths. The low exploitation probability does not negate the privilege‑escalation potential, warranting prompt action.