A use‑after‑free flaw occurs in the kernel’s lp8788 charger driver when the device is removed. The driver attempts to flush pending work before unregistering interrupts so that an IRQ thread can still schedule work after the flush. As a result, the work may later dereference memory that has already been freed, a classic use‑after‑free scenario under CWE‑364. The symptoms can include a memory corruption that may lead to a kernel panic or other unstable behavior.

All Linux kernels that compile the lp8788 charger driver are potentially affected. No specific kernel version or distribution is listed, meaning any kernel that includes this driver and does not incorporate the patch could be vulnerable.

The CVSS score of 4.1 labels the flaw as moderate severity, while the EPSS score of <1% indicates a very low but non‑zero probability of exploitation. Because the bug requires manipulation of driver removal or a power event, it is likely confined to local or privileged actors; remote exploitation is not indicated. The flaw is not listed in CISA’s KEV catalog, which further suggests it is.