The Linux kernel's mailbox driver contains a flaw in the shutdown logic for receive (rx) channels. During device removal, the code mistakenly treats a NULL channel pointer as if the channel was present, leaving the mailbox enabled and allowing it to receive messages after the device has been detached. This results in a use‑after‑free condition where the driver may process packets using freed memory, which can lead to kernel memory corruption or unwanted code execution if an attacker can trigger the faulty path. The weaknesses are classic memory corruption issues (CWE‑416 and CWE‑825).

The affected product is the Linux kernel, specifically the mailbox driver that can be present in any kernel build containing the buggy shutdown logic. Any Linux distribution that ships the unpatched kernel is at risk. No specific kernel version is stated, so any build dated before the referenced commits should be considered vulnerable.

The CVSS score is 5.5, the EPSS score is < 1%, and it is not listed in CISA's KEV catalog. However, exploitation would require local privileged access or control over the device removal sequence. If an attacker can trigger the removal while the driver is still active, they could achieve kernel execution through the use‑after‑free flaw. The likelihood of exploitation is uncertain without a published exploit, but given the severity of a kernel memory corruption, the vulnerability should be treated as a high‑impact local flaw until resolved.