The Linux kernel’s platform/x86 Android tablet code allows a use‑after‑free during secondary firmware node teardown. A device reference returned by acpi_bus_find_device_by_name() is prematurely dropped, yet the same pointer is stored for later cleanup without incrementing its reference count. If the kernel releases the device before the cleanup routine runs, an attacker could dereference a dangling pointer, corrupting kernel memory and executing arbitrary code with kernel privileges.

All Linux kernel builds that include the platform/x86 Android tablet support are potentially affected; any kernel that contains this buggy logic is vulnerable until the patch is applied.

This kernel‑level memory corruption can raise privileges to the kernel level. The CVSS score is 5.5, indicating medium severity. The EPSS score of less than 1 % suggests a low overall exploit probability in the wild, but the fix required is a full kernel rebuild and the flaw remains a high‑risk local issue. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local: an adversary would need to execute code in kernel context, such as by triggering the fwnode teardown or exploiting another local vulnerability. No temporary workaround exists beyond disabling the feature until a patch is available.