The Linux kernel’s Airoha NPU driver contains a use‑after‑free flaw. When the device is removed, cancel_work_sync is called after the watchdog IRQ has already been freed with devm_request_irq, yet the IRQ handler can still schedule the same work descriptor again. Because the work structure resides in a devm_kzalloc buffer that is deallocated during the same cleanup, the queued work may execute on freed memory. This condition can corrupt kernel memory and crash the system; based on the description it could also allow arbitrary code execution if an attacker can trigger the out‑of‑order execution—this possible exploitation scenario is inferred from the supplied comments.

All Linux kernel builds that include the Airoha NPU driver are potentially vulnerable. The CVE text does not list specific kernel versions, so any system running a kernel with the unpatched airoha_npu_remove implementation following the described sequence may be exposed.

The CVSS score of 4.1 indicates moderate severity, and the EPSS score is below 1%, implying a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known active exploits. Exploitation would require provoking a watchdog interrupt after the device’s resources have been torn down, which generally demands privileged kernel access or an additional flaw that permits kernel code execution. Consequently, while the bug represents a serious kernel fault, its practical exploitability is limited without elevated privileges and it is unlikely to be observed in the wild currently.