The kernel’s corsair‑cpro hwmon driver creates debugfs files before completing the hwmon registration. If registration fails, the driver leaves those files behind while the underlying device structure has already been freed. When an application later reads one of these dangling debugfs entries, it dereferences a freed pointer, causing a kernel panic and denying service.

All Linux kernel builds that include the unpatched corsair‑cpro hwmon driver are at risk. The patch is in the mainline kernel source, so any kernel compiled before the fix is vulnerable. Kernels updated after the fix are no longer affected.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of <1% and absence from CISA KEV suggest a low likelihood of current exploitation. The likely attack vector is a local attacker with privileged access, such as a root user; this inference follows typical debugfs permission settings. A successful read of the dangling debugfs entry would trigger a kernel crash, impacting availability of the affected system.