In the Linux kernel's DRM I2C driver, a use‑after‑free (UAF) vulnerability exists because the xe_i2c structure is freed before the SGUnit IRQ is disabled during the unbind path. If an I²C interrupt occurs during this narrow window, the kernel may read or write freed kernel memory, potentially leading to a kernel panic or remote code execution. The weakness also involves an improper resource release flaw (CWE‑825).

The affected product is the Linux kernel itself. Version information is not explicitly provided in the advisory, so any kernel build that incorporated the unbind xe_i2c path prior to the patch may be vulnerable. Users should verify whether their running kernel contains the commit that disables the IRQ in xe_i2c_remove().

The EPSS score indicates a very low exploitation probability (<1%), and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 7.0 indicates a high severity. Exploitation requires the I²C IRQ to fire while the driver is in the unbind stage, a condition that is unlikely to occur by accident but could be triggered by a malicious I²C device or firmware. Until the kernel is updated, the risk remains moderate to high for systems that expose the affected device to untrusted input or hardware.