The kernel LP872 delayed work task in its IRQ handler while the IRQ resource remains active. The release function then frees the IRQ before cancelling the work, allowing a subsequent interrupt to re‑arm the work. If the device is removed, the work may run after the driver data has already beenafter‑free that can crash the kernel or corrupt critical memory. This flaw is a classic CWE‑825 scenario exposing the kernel to arbitrary memory corruption from within a privileged driver.

Any installation of the Linux kernel that includes the LP8727 driver and runs a kernel commit prior to the fix commit 6ab3128292df67295de1b2a86f21d89cf6612a7e. The affected product is the Linux kernel’s LP8727 power‑supply module, which is employed on systems using the LP8727 power management chip.

The CVSS score of 6.4 indicates medium severity. EPSS is reported as < 1%, indicating vulnerability is not listed in CISA KEV. Based on the description, it is inferred that the attack vector is local or requires privileged access, as the flaw requires a maliciously crafted interrupt or device intervention. Successful exploitation could lead to kernel destabilization and potential privilege escalation, but would likely need a maliciously crafted interrupt or device intervention.