The ath9k_htc Wi‑Fi driver stored the usb_device_id during device probe, but that identifier can change or be released after the probe phase. The driver therefore kept a reference to a memory location that is no longer valid, creating a use‑after‑free condition. An attacker who can inject or manipulate USB devices could trigger this dangling pointer, causing the kernel to crash or potentially execute injected code. The primary consequence is kernel memory corruption that could lead to denial of service or privilege escalation.

Systems running the Linux kernel with the ath9k_htc driver before the fix are affected. This includes any distribution that ships an older kernel version where the driver still stores usb_device_id. No specific kernel release numbers are listed, so all deployments prior to the applied patch are at risk.

The CVSS score of 5.5 indicates a moderate severity, and the EPSS score of < 1% shows a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Because the issue occurs in kernel space, a local attacker capable of controlling USB device traffic could trigger a use‑after‑free, resulting in a kernel crash or privilege escalation. While exploitation would require hardware interaction, the risk remains high where the vulnerable driver is.