The Linux kernel’s I2C ATR driver stores a pointer to an ATR channel in the adapter array before the adapter register operation succeeds. If the registration fails, the channel resource is freed, but the adapter array still holds the stale pointer. Subsequent cleanup or deregistration functions later dereference that pointer. This use‑after‑free can corrupt kernel memory, potentially causing a kernel crash or allowing an attacker to execute arbitrary code in kernel mode.

Any Linux kernel build that includes the I2C ATR driver without the patch committed in the referenced kernel Git changes is affected. Because the advisory does not specify a particular kernel release, all releases containing the driver prior to the fix are subject to the flaw. Systems running kernel versions that implement the referenced commit are not vulnerable.

The CVSS score 5.5 indicates a medium severity. The EPSS score is less than 1% and the vulnerability is not listed in CISA KEV, so there is no known public exploitation. Based on the description, it is inferred that the likely attack vector requires a local or privileged process that can trigger a failed I2C adapter registration. If such a process exists, the resulting memory corruption could be leveraged for local privilege escalation or denial of service. The probability of exploitation is low, but the potential impact justifies prompt remediation.