The vulnerability resides in the Linux kernel’s hwmon corsair‑cpro driver. During probe, debugfs files are registered using memory that is allocated via devm. If registration fails after debugfs setup, the debugfs entries are left unreleased. A reader of those files then dereferences a freed pointer, resulting in a use‑after‑free that can corrupt kernel memory and potentially allow arbitrary code execution.

All Linux kernel instances that include the Corsair CPro hardware monitor driver before the fix are affected. Because the driver is part of the standard kernel source tree, any kernel built with the hwmon:corsair‑cpro module inherits the flaw. No specific kernel version range is disclosed, so any kernel with the unpatched driver may be vulnerable.

Based on the description, it is inferred that the attack would require local privileged access to read the exposed debugfs file, which then triggers the use‑after‑free. The CVSS score of 5.5 indicates medium severity; the EPSS score of less than 1% points to a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Consequently, while the flaw can lead to kernel corruption, widespread exploitation is unlikely without local privileges, and systems can mitigate the risk by applying a patched kernel or blocking access to the vulnerable debugfs entries.