The vulnerability arises in the Linux kernel’s twl4030 charger driver when a device is removed. Two work queues that reference a devm‑allocated structure are not cancelled before the structure is freed. As a result, a worker can run after its backing memory has been released, causing a dangling pointer dereference and memory corruption. This flaw can lead to kernel crashes, loss of service, or, in more extreme cases, could be exploited to gain escalated privileges if an attacker can control the removal sequence.

All Linux kernel versions that include the twl4030 charger driver and contain the unsafely cancelled work queues are affected. The exact affected kernel series is not listed by the CVE, so systems running recent releases that have not yet adopted the upstream fix should be reviewed.

The CVSS base score of 4.4 indicates moderate severity. The EPSS score of <1% indicates that the overall likelihood of exploitation remains very low, although the presence of the weakness remains. the C are no known active exploits. The vulnerability requires local privileges to trigger a race between device removal and a work queue that still references the freed devm object, meaning the attack surface is limited to privileged users or compromised firmware. Nonetheless, the use‑after‑free can still cause kernel crashes and service disruption.