The vulnerability originates from a use‑after‑free condition in the Linux kernel HID driver. When a device using the winwing driver is removed or the module is unloaded, the force‑feedback subsystem frees driver data that is still owned by the device framework, causing a double free and corrupting kernel memory. Such corruption can trigger kernel panics, potentially enabling arbitrary code execution with elevated privileges or causing a denial of service that impacts all users on the affected system.

All distributions that ship the Linux kernel with the winwing HID driver enabled. The vulnerability arises at the kernel level and is not limited to a specific product version; it affects any system that uses this driver until the reported patch is applied.

The CVSS score and exploit probability are not provided; however, because the flaw occurs in privileged kernel code and involves a double free leading to memory corruption, the exploitation risk is considered high. No public exploits are listed in CISA’s KEV catalog, but the kernel nature of the bug means a local attacker could cause severe impact if the driver is bound to a device. The likely attack vector is local privilege escalation or denial of service via manipulation of HID devices or Module unloads. Without a patch, systems remain at high risk until the kernel snapshot containing the fix is deployed.