In the Linux HID sensor subsystem, custom sensor fields create sysfs groups during initialization. If sysfs_create_group() fails after creating some groups, the function returns an error while leaving the partially created groups in place. Because these groups reference memory that may have been freed or left uninitialized, subsequent accesses to the enable_sensor interface can follow stale pointers, resulting in a use‑after‑free that can corrupt kernel memory. The flaw corresponds to CWE‑772, an improper cleanup of resources that can lead to this vulnerability.

The flaw is present in any Linux kernel build that includes the HID sensor custom feature before the committed fix. All distributions that enable this module in the kernel configuration or load a module that defines custom sensor kernel itself, not in user space programs.

The AV is rated moderate with a CVSS score of 4.4 and an EPSS score of < 1 %. The vulnerability is not listed in CISA KEV, indicating a low likelihood of active exploitation. Based on the description, it is inferred that the ability to load the custom sensor module or write to its sysfs interface, which typically requires kernel or root privileges, or a kernel exploit that enables loading of privileged modules.