During a hot‑plug or removal event of an SDIO host controller, the kernel schedules a work item that can still run after the host structure has been freed. The work item dereferences the freed host pointer, causing a use‑after‑free. This kernel‑level memory corruption can lead to arbitrary code execution with ring 0 privileges or cause a denial‑of‑service by crashing the system. The bug stems from missing cancellation of the work item on the remove path and corresponds to CWE‑825.

The issue affects any Linux system running a kernel that incorporates the sdio_signal_irq path for SDIO host controllers without the patch. The exact affected releases are not listed, but all kernels prior to the commit that introduced the removal‑path cancellation are vulnerable. Systems that use SDIO host drivers such as embedded or mobile devices, laptops, or other hardware with SDIO interfaces are at risk.

Based on the description, it is inferred that the exploit requires local or physical access to trigger the removal or hot‑plug of the SDIO controller, as the bug occurs during the host free path. No publicly documented remote exploit is available, and the EPSS score is less than 1%; the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, given the kernel context and the nature of the use‑after‑free, the potential impact is severe. The CVSS score of 7.0 indicates a high severity level.