The rt9455 power‑supply driver in the Linux kernel schedules several delayed work functions. When the driver is removed or a probe fails, the removal routine cancels some of those work items but not all, allowing a queued function to run after the driver’s data structure has been freed. This use‑after‑free can cause a kernel crash or provide a path for privilege escalation. The flaw is identified as CWE‑825. Based on the description, it is inferred that the flaw arises when a work function re‑queues another after cancellation, leading to dereferencing freed memory.

All Linux kernel builds that compile the rt9455 driver are potentially affected. Exact affected versions are not listed in the advisory, but any release prior to the patch that implements the correct cancellation sequence remains vulnerable. The driver is part of the mainline kernel for many distributions, so the impact is widespread across Linux systems that use that power‑supply component.

The advisory rates the CVSS score as 7.5, indicating high severity. The EPSS score is less than 1%, indicating a very low probability of exploitation. The vulnerability is not recorded in CISA’s KEV catalog, suggesting that exploitation activity has not been observed yet. Based on the description, it is inferred that the likely attack vector requires local access to trigger device removal or a probe‑failure path; remote exploitation is unlikely because the flaw is tied to kernel driver internals and not exposed to user level. Nevertheless, the use‑after‑free can cause kernel crash or privilege escalation if an attacker can manipulate the hardware interface that loads the rt9455 driver.