In the Linux kernel, the pulsedlight IIO proximity driver can leave an IIO device registered after a failure in pm_runtime_set_active() during probe. The error path cleans the buffer but does not undo the successful iio_device_register(), causing the IIO core to reference freed memory. As a result, the device’s sysfs and character‑device nodes remain present and point to invalid memory, creating a use‑after‑free condition that may trigger a kernel crash when the orphaned device is accessed.

Any Linux kernel that contains the pulsedlight IIO driver before the commit that added the error_unreg_dev cleanup path is potentially affected. Distribution‑specific impact is not listed in the data; users should inspect kernel release notes or verify whether the referenced commits are present in their kernel source.

The CVSS score of 7.0 and the EPSS score of less than 1% indicate a high impact potential but a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, and no publicly reported exploitation activity is known. The flaw represents a classic kernel use‑after‑free that can cause a kernel panic. Based on the description, the likely attack vector is local: an attacker with the ability to trigger the pm_runtime_set_active() failure and subsequently access the orphaned IIO device (for example, via sysfs or the character device), which could lead to arbitrary kernel code execution or denial of service. This attack vector is inferred from the nature of the driver and the use‑after‑free, as it is not explicitly stated in the advisory.