The Linux kernel’s OXP HID driver used cancel_delayed_work() to cancel pending tasks during device removal. Cancel_delayed_work() only dequeues the task and does not wait for an executing callback to finish. When the OXP HID device is closed, any callback still running can continue to access the device after it has been stopped, resulting in improper use of freed or closed resources. At worst this race can corrupt kernel memory, trigger a crash or allow an attacker to gain higher privileges locally by exploiting the corrupted state.

Affected systems are Linux kernel installations that include the OXP HID driver. No specific kernel version is listed, so all current releases that contain the unpatched OXP HID driver may be vulnerable until the fix is applied.

The vulnerability is a local kernel issue and requires an attacker to influence the timing of driver removal while work callbacks are scheduled. The EPSS score is not available, and it is not listed in the CISA KEV catalog, indicating no publicly known exploits yet. Nevertheless, because a kernel crash or memory corruption can lead to a denial of service or, if exploited, local privilege escalation, the risk is considered high until the patch is deployed.