The flaw occurs when the DRM/xe I2C driver removes an adapter without draining scheduled work. A queued work item may continue to run after the adapter has been unregistered and the backing structure freed, causing a use‑after‑free on kernel memory. This can corrupt kernel data structures and lead to a crash or, if an attacker can influence the work payload, a form of arbitrary kernel memory write.

Any Linux kernel that implements the drm/xe/i2c DesignWare adapter driver before the patched commit is affected. No specific kernel version numbers are listed in the advisory, so all kernels derived from source containing the old notifier logic are considered at risk until the fix is applied.

The CVSS score of 4.1 indicates moderate severity, and the EPSS score is <1%, indicating a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local privileged context that can trigger the removal of the I2C device, such as a privileged process or a management script. The use‑after‑free nature of the flaw suggests a high impact if exploited, potentially causing a kernel panic or enabling an attacker to corrupt memory if further controls (e.g. the work queue payload) can be manipulated. The overall risk is elevated due to the kernel‑level memory corruption potential, but exploitation requires local privilege or the ability to control the driver removal sequence.