The Linux kernel’s charlcd component schedules a delayed backlight work item before registering a misc character device. If registration fails, the delayed work still references the device object, which the caller frees, leaving stale pointers. This results in a use‑after‑free condition that could allow an attacker to trigger memory corruption, potentially leading to a crash or more severe kernel compromise. The weakness is identified as CWE‑825: Use‑After‑Free.

All Linux kernel builds that enable the charlcd driver, particularly those compiled with CONFIG_CHARLCD_BL_FLASH. The issue is present in any kernel version prior to the fix that introduces a dedicated cleanup routine (charlcd_deinit) to cancel the delayed work and disable the backlight.

The overall CVSS score of 4.4 suggests a moderate severity. EPSS score is less than 1% and the vulnerability is not listed in CISA’s KEV catalog, indicating no known widespread exploitation. The attack vector is likely local, relying on a failed registration of the charlcd misc device to exploit the use‑after‑free. Because the flaw is limited to a kernel module and requires specific configuration, the risk of widespread impact remains low under normal conditions.