The w83791d hardware‑monitor driver for the W83791D I2C chip fails to clean up the fan/pwm 4‑5 sysfs group when it is normally torn down, a flaw that falls under the CWE‑825 category. During a normal removal, the driver deletes only its primary sysfs group, leaving the optional fan/pwm 4‑5 directory and its files in place. The callbacks for those files reference driver data that was allocated with devm and freed when the driver unbinds. Because the sysfs entries remain, any subsequent read or write to them can dereference a freed pointer, resulting in a use‑after‑free condition that may crash the kernel or leak kernel memory. As the callbacks run in kernel space, exploitation leads to denial of service.

All Linux kernels that include the w83791d driver before the repair commit (identified by the commit SHA 081e3a7845). This includes any distribution kernel that ships the unpatched module for monitoring W83791D hardware on I2C buses. The vulnerability affects systems that load the driver and later unload or unbind it, regardless of vendor distribution.

The CVSS score of 7 indicates high severity, but the EPSS score of less than 1% shows a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, so no publicly known exploits have been reported. The likely attack vector is local privilege escalation or administrative intervention, as the dangling sysfs entries are generally accessible only to root or users with write permission to /sys. An attacker who can trigger a module unload/rebind or manipulate the sysfs interface could induce a use‑after‑free in kernel space, leading to a denial‑of-service crash or potential memory disclosure.