The vulnerability is a use‑after‑free bug in the Linux kernel’s ucsi/GLINK driver. During removal of a UCSI‑enabled USB Type‑C device, the pmic_glink client cleanup runs after ucsi_unregister() has returned. The driver’s work items may still reference a connector array that has been freed or attempt to unregister the instance again, causing access to freed memory. This can corrupt kernel memory or trigger a kernel crash.

Any Linux kernel that implements the ucsi/GLINK subsystem contains the vulnerable code. The advisory does not list specific kernel versions, so any kernel build that includes this subsystem on a system that supports USB Type‑C could be affected.

The CVSS score of 4.1 points to a low‑to‑moderate severity. The EPSS score of <1% indicates a very low probability of exploitation today. Based on the description, it is inferred that an attacker would need local privileged access to trigger device removal. Based on the description, the likely attack vector is local or requires physical removal or reset of a USB device; remote exploitation would entail causing a removable device to be disconnected, which is unlikely on most systems. Because the bug can cause a kernel crash or memory corruption, it may pose a moderate risk to availability and integrity on affected machines.