A use-after-free is present in the PCI plda driver when a device is torn down. The driver removes an IRQ domain while IRQs that were requested with devm_request_irq() are still scheduled for deferred cleanup. When the deferred free_irq() runs, it dereferences data that has already been freed, potentially causing a crash of the kernel or an arbitrary pointer dereference. No evidence in the description indicates remote exploitation or code execution; the impact is limited to a system crash if the software performs the problematic teardown path.

The vulnerability exists in the Linux kernel PCI plda driver. All kernel releases that include the unpatched plda driver are affected. The patch was verified on a StarFive VisionFive v1.2A board. No specific version range is listed, so any kernel containing the pre-patch code is vulnerable until the countermeasure is applied.

The CVSS score of 4.1 indicates a medium-severity flaw primarily affecting availability. The EPSS score is 0.002, indicating a very low exploitation probability, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is local, as the flaw requires the, which an attacker can trigger by manipulating PCI devices or by provoking driver unload/reload events. The exploitability condition is that the device must be removed after driver initialization, a path that typically requires local access or privilege escalation.