In the Linux kernel, the gpio‑fan driver schedules fan alarm work items that may be executed after the associated fan_data structure and hwmon device are freed during device unbinding. This use‑after‑free can corrupt kernel memory when the work handler dereferences a released pointer. The effect is kernel memory corruption and potential system instability, but the CPE data does not list any successful exploitation.

Any Linux kernel that includes the gpio‑fan driver is affected. The advisory does not specify an exact version range, so all kernels containing the unpatched implementation of fan_alarm_irq_handler and fan_alarm_notify remain vulnerable while the device is unbound. No vendor versioning is provided in the CNA data.

The vulnerability receives a CVSS 5.5 score, representing medium severity. EPSS is less than 1%, indicating a low chance of exploitation in the wild. It is not listed in CISA's KEV catalog. Attack likely local: an attacker would need to trigger a pending fan alarm while the device is being unbound, which requires privileged or local access to hardware monitoring interfaces. No remote exploitation path is documented in the input.