This vulnerability is a use‑after‑free condition in the Linux kernel charger management driver. During removal or error paths, the driver frees regulator objects before the associated sysfs entries are torn down. A concurrent write to the externally_control sysfs attribute can trigger a dereference of the already‑freed consumer handle. This may crash the kernel, produce a denial of service, or, in theory, allow an attacker with control over the freed memory contents to execute code. The patch resolves the issue by reordering regulator acquisition and sysfs registration, ensuring symmetrical teardown and preventing the race condition.

Based on the CVE data, all Linux kernel implementations that include the charger‑manager component are affected. The vulnerability applies to any kernel where the charger regulator subsystem is enabled, regardless of distribution or version, as no specific version ranges were identified.

The CVSS score is 5.2, indicating moderate severity. The EPSS score is < 1 %, suggesting a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The most probable attack vector is a local user or process with write permission to the charger’s externally_control sysfs attribute; while local privilege escalation or denial of service is a credible risk, exploitation remains unlikely under normal conditions. Environments that expose charging or external control to untrusted users should consider mitigating the risk.