The Linux kernel ATA driver for the SL82C105 bridge contains a use‑after‑free flaw: a reference to a PCI device is released with pci_dev_put() before the driver reads the cached revision field. This can corrupt kernel memory. It could potentially allow an attacker to alter kernel data or trigger a denial of service; that potential impact is inferred from the nature of the vulnerability.

All Linux kernel builds that include the unpatched ATA SL82C105 driver are affected. The issue was corrected in commit 44c10138fd4b; any kernel version prior to that commit that still contains the buggy code path is at risk. Vendor labels indicate the affected product is the Linux kernel.

The CVSS score of 7.8 indicates high severity. The EPSS score of less than 1% points to a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack likely requires local privileged access to trigger, although the exact vector is not detailed in the advisory and is inferred from the driver’s context.