The vulnerability originates from a use‑after‑free condition in the Linux kernel HID driver. When a device using the winwing driver is removed or the module is unloaded, the force‑feedback subsystem frees driver data that is still owned by the device framework, causing a double free and corrupting kernel memory. Such corruption can trigger kernel panics, potentially enabling arbitrary code execution with elevated privileges or causing a denial of service that impacts all users on the affected system.

All distributions that ship the Linux kernel with the winwing HID driver enabled. The vulnerability arises at the kernel level and is not limited to a specific product version; it affects any system that uses this driver until the reported patch is applied.

The CVSS score of 5.5 and an EPSS score of less than 1% have been assigned to this vulnerability, indicating a moderate severity and a low likelihood of exploitation. Because the flaw occurs in privileged kernel code and involves a double free that corrupts kernel memory, the potential impact remains significant, allowing a local attacker to cause a system crash or potentially achieve privilege escalation. No public exploits are listed in CISA’s KEV catalog. The likely attack vector is local, through removal of a device that uses the winwing driver, module unload, or entering a system suspend state. Without a patch, affected systems remain vulnerable until the kernel update is applied.