The flaw occurs when an ad_sigma_delta device is unbound while its interrupt service routine is still enabled. A freed buffer is later written to by the trigger handler, which can corrupt kernel memory. If the corrupted data is exploited, an attacker could trigger a kernel fault or execute arbitrary code with kernel privileges.

The affected component is the generic Linux kernel. No specific kernel version numbers are listed in the data; the issue applies to any release that includes the unpatched ad_sigma_delta driver code.

EPSS data indicates an exploitation probability of less than 1%, and the CVSS score of 4.1 denotes low‑to‑moderate severity. The vulnerability is not listed in CISA's KEV catalog. Attackers would need to trigger an unbinding of the ad_sigma_delta device while its interrupt service routine remains active, requiring local control over the hardware or privileged removal, to force a use‑after‑free. The freed buffer could be written to by the trigger handler, corrupting kernel memory, which could lead to a kernel crash, denial of service, or, if crafted data is supplied, a privilege escalation to kernel mode.