The Linux kernel HID sensor subsystem contains a use‑after‑free vulnerability in enable_sensor_store(). This function may call set_power_report_state() and dereference power_state and report_state pointers that refer to entries in sensor_inst->fields. If enable_sensor is accessed before these fields are initialized or after they are freed, the dereference may read or write corrupted memory. In a kernel context such memory corruption can allow a local attacker to corrupt kernel data or execute arbitrary code, resulting in privilege escalation or a system crash.

The vulnerability affects all Linux kernels that include the custom HID sensor driver and expose the enable_sensor sysfs attribute. No specific version range is provided, but any kernel where this attribute exists is potentially impacted until the fix is applied.

The CVSS score is not reported, EPSS is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local interaction with the sysfs interface; an attacker with write permission to /sys/.../enable_sensor can trigger the use‑after‑free before proper initialization. Kernel memory corruption may lead to full privilege escalation. While exploitation may require local access, the severity of the potential impact warrants a prompt patch.