A bug in the Linux kernel device driver framework caused an unexpected warning when a device is removed while its supplier is still being unbound. The warning originates from an internal state check in __device_links_no_driver and indicates a state transition flaw that can be mapped to CWE‑617 (Use After Free). The flaw does not lead to a crash, denial of service, or any other security‑relevant effect; it merely logs a kernel warning message when the driver removal order reaches a specific state transition. Thus the impact is limited to non‑critical warning messages and no compromise of confidentiality, integrity, or availability.

All Linux kernel implementations that contain the device core driver code, prior to the application of the cited patch in the kernel source. No specific kernel versions are listed, so the issue is likely present across all affected releases until the fix is merged.

The vulnerability carries a moderate risk profile with a CVSS score of 5.5. The EPSS score is <1% and the issue is not listed in the CISA KEV catalog. The warning is triggered only during device removal and requires local interaction with the kernel driver interface. There is no known exploitation vector beyond normal operating conditions of the affected hardware, and no evidence of remote or privileged attacker advantage.