The MCP2221 USB‑to‑I2C HID driver stores the caller‑supplied buffer pointer in an internal field (mcp->rxbuf) during an I2C/SMBus read operation but never clears it when the transfer ends or times out. If the caller later frees or reuses the buffer, the driver now holds a dangling pointer. A delayed MCP2221_I2C_GET_DATA report can cause the raw_event handler to copy data into that freed memory, producing a kernel write‑use‑after‑free and resulting in memory corruption. This corruption could destabilize the kernel and, while the CVE does not explicitly state privilege escalation, an gain local elevation (inferred).

The flaw lives in the Linux kernel's HID subsystem for the MCP2221 driver. All kernel releases that include this driver code before the fix that clears the rxbuf pointer after a transfer are affected. This impacts any Linux system (any distribution or vendor) running an unpatched kernel with the MCP2221 driver enabled. The affected product is the Linux kernel, specifically the mcp2221 HID driver component.

The CVSS score of 7.0 signals moderate‑to‑high severity. The EPSS score of less than 1% suggests a low probability of widespread exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is local and requires the presence of an MCP2221 device attached to the machine and the ability to trigger an I2C/SMBus read operation. Successful exploitation would first corrupt kernel memory and could allow an attacker with local access to attempt privilege escalation (inferred).