In the Linux kernel, a use‑after‑free occurs in the MMC hsq subsystem when the sdhci‑sprd driver schedules a retry work item that remains pending during driver removal. The retry work is allocated with devm and is not canceled, so it can run after the devm memory has been freed, dereferencing pointers that no longer exist and causing a kernel panic. This crash can abruptly terminate user‑space processes and render the operating system unusable. Based on the description, it is inferred that an attacker needs the ability to unload or restart the affected driver, a capability typically restricted to privileged users.

The flaw affects Linux kernel systems that include the MMC hsq subsystem in conjunction with the sdhci‑sprd driver. Any kernel version that bundles the unpatched mmc_hsq implementation is potentially vulnerable, regardless of hardware configuration. The weakness is specific to environments where this driver is loaded and active.

The CVSS score of 5.5 denotes a moderate severity. The EPSS score of < 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires privileged access to unload or restart the driver, which makes the threat largely local. Consequently, the risk is best characterized as a moderate local denial of service that can be achieved only by attackers with kernel module management privileges.