The vulnerability is a use‑after‑free in the Linux kernel’s UCS1002 power‑supply driver. When the device is removed, a delayed work routine is still queued by an IRQ handler and may run after the driver data has been freed by devm. This results in the routine dereferencing freed memory, leading to a kernel crash and system reboot. The description explicitly states that this dereference can crash the kernel, implying a denial‑of‑service outcome.

All Linux kernel builds that include the unpatched UCS1002 power‑supply driver are affected. The defect exists in any kernel release prior to the commit that registers the health_poll work with devm_delayed_work_autocancel. No specific version strings are listed, so any kernel that contains the legacy driver configuration is potentially vulnerable.

The CVSS score for this issue is 5.7, indicating a moderate severity. The EPSS score is below 1%, indicating a very low but nonzero exploitation probability, and the vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is local or requires privileged execution to trigger driver removal or a bad‑health condition. An attacker would need sufficient local access to load or unload the module or manipulate the device state; remote exploitation is unlikely without additional attack surface. The impact of a kernel crash is high, so the overall risk is moderate to high if an attacker has the necessary local privilege.