The vulnerability is a use‑after‑free that occurs when the Linux kernel bq24257 power‑supply driver is removed. The driver registers a STAT‑pin interrupt that remains active until the device‑managed the driver cancels a work queue item, but the interrupt handler may still fire and reschedule that work, dereferencing the driver data structure after it has been freed. Referring to freed memory can cause memory corruption and potentially a kernel crash.

All Linux kernel installations that include the bq24257 driver before the commit that applies the fix. The advisory does not list specific kernel versions, so any kernel build that contains the driver prior to the change is vulnerable.

The CVSS score is 5.2, indicating moderate severity. The EPSS score is <1%, and the flaw is not listed in the CISA KEV catalog. Exploitation would likely require local privilege to trigger the removal path, such as an attacker who can drive a device removal or unload the driver. While public exploitation appears unlikely due to the low EPSS, the impact of a successful exploit is significant because it can corrupt kernel memory or crash the system.