In the Linux kernel, several EDAC/altera setup callbacks—including sdmmc, ethernet, nand, dma, usb, qspi—and their helper functions were mistakenly marked with the __init attribute. These functions run during probe paths that can execute after the __init memory region has been freed, such as when a probe is deferred via –EPROBE_DEFER or during a manual unbind/rebind. The consequence is a use‑after‑free scenario that exposes the kernel to memory corruption and potentially arbitrary code execution in privileged mode. Additionally, the misuse of __init in these callbacks signifies an improper initialization flaw (CWE‑825).

All Linux kernel builds that contain the EDAC/altera driver and the affected __init functions are subject to the flaw. No specific vendor or version list is provided, so any kernel prior to the fix that includes these callbacks is potentially vulnerable.

The CVSS score of 4.1 is relatively low, and the EPSS score is below 1%, indicating a low likelihood of exploitation. However, the flaw can still be triggered by local actions that manipulate probe timing or module bindings; an attacker with the ability to load or rebind modules can cause the freed memory to be dereferenced, leading to privilege escalation or denial of service. The vulnerability is not listed in CISA’s KEV catalog, but the attack vector is plausible for users with kernel module privileges.