The Linux kernel OXP HID driver was removing a device by calling cancel_delayed_work() on all delayed work items. Because cancel_delayed_work() only dequeues a work item without waiting for an already running callback to finish, any active callback—such as oxp_rgb_queue_fn, oxp_btn_queue_fn, or oxp_mcu_init_fn—could continue executing concurrently with hid_hw_close() and hid_hw_stop(). This race condition allows the callback to access a HID device that has already been closed, potentially causing a kernel panic or other failure. The primary impact is a denial of service caused by a kernel crash.

Linux kernel installations that include the unpatched OXP HID driver are affected. Hardware relying on the OXP HID interface (e.g., OXP‑based USB devices) may trigger the vulnerability when the driver removes or disconnects a device. No specific kernel version is listed; any kernel containing the OXP HID driver prior to the commit that replaces cancel_delayed_work() with cancel_delayed_work_sync() is vulnerable.

The vulnerability is local; an attacker must trigger a device removal while a delayed work callback is running. The medium CVSS score of 4.1 reflects the limited impact. The EPSS score of less than 1% indicates a very low probability of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not been publicly exploited. The risk is moderate but the impact is a system crash that results in denial of service.