The Anx7411 USB Type- C controller driver in the Linux kernel fails to disable its interrupt request when destroying its workqueue during device removal. Consequently, queued work still executes after the queue is torn down, accessing freed resources and potentially leading to a kernel crash or other unstable behaviour. This manifests as a denial-of-service at the system level.

All Linux kernel implementations that include the Anx7411 USB Type- C driver. The specific affected kernel releases are not enumerated in the advisory, so any kernel that contains the unpatched code is potentially vulnerable.

The vulnerability currently has a CVSS score of 4.7, indicating moderate severity. The vulnerability could be triggered by a normal removal or power cycling of the USB Type- C controller, which is a scenario normally performed by the kernel during shutdown or unplugging events. Based on the description, it is inferred that an attacker would need kernel-level privileges to provoke the race condition, as the removal process is not exposed to unprivileged users; however, the CVE description does not explicitly state the privilege requirements. The EPSS score of 0.00168 indicates a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalogue. Given the lack of a publicly demonstrated exploit, the risk remains theoretical until such a proof‑of‑concept is published, but the potential for a kernel crash necessitates prompt action.