A race condition in the Linux kernel’s hwmon pwm‑fan driver allows the RPM timer to fire after the tachometer data arrays have been freed. The timer callback then accesses deallocated memory, creating a use‑after‑free flaw that can corrupt kernel memory and lead to a panic. The CVE description states that the flaw is triggered only during a brief window while the driver is unbinding and the timer is still active, and no information is provided that an attacker can influence the content of the freed data or force the timer to execute in a controlled way.

All Linux kernel releases that include the default hwmon pwm‑fan driver before the recorded fix are affected. Distributions shipping an unpatched kernel that contains the vulnerable code are therefore at risk; the generic CPE entry indicates the issue is not limited to a particular vendor or kernel version.

The EPSS score is below 1 % and the vulnerability is not listed in CISA’s KEV catalog, implying a low likelihood of exploitation in the wild. The race window is very narrow and requires a local context where the driver can be unbound while the timer remains active, limiting the attack vector to local crash or denial of service. The CVSS score of 5.5 reflects a moderate severity, primarily due to the potential for system instability rather than privilege escalation or data exposure.