The vulnerability originates in the Linux kernel’s Industrial I/O light sensor driver for the gp2ap020a00f device. During driver removal or an error path in probe, the code calls free_irq() while an irq_work task remains queued. Because free_irq() does not automatically flush this queued work, the work may still run after the device’s trigger context has been freed. This results in a use‑after‑free condition that can corrupt kernel memory or potentially allow execution of attacker‑controlled code if an attacker can influence the removal sequence.

All Linux kernel distributions that ship the gp2ap020a00f IIO light sensor driver without the patch that adds irq_work_sync in the remove and probe error paths are affected. The specific vendor is Linux; the product is the Linux kernel. No precise version range is provided, but any kernel that has not yet incorporated the commit that fixes the issue is vulnerable.

The CVSS score of 4.7 suggests low to moderate severity, and the EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The use‑after‑free flaw is typically exploitable in a local or privileged context where an attacker can trigger device removal or reload the driver. The denial of service or privilege escalation potential is still significant, as the kernel memory corruption could lead to system instability or escalation if code execution can be achieved. The vulnerability is not currently listed in the CISA KEV catalog, indicating no widespread exploitation has been reported yet. The likely attack vector is local, requiring control over driver unload operations, and no publicly documented remote exploitation vector exists.