When the memstick core process waits for an asynchronous request using a timeout, the card structure is freed if the timeout expires before the request completes. The host controller driver continues the request asynchronously and later writes to memory that has already been freed, triggering a KASAN slab‑use‑after‑free. This memory corruption occurs in kernel space and can alter kernel data structures or executable code, as demonstrated by the KASAN log output.

All Linux systems that compile the memstick core code and load host controller drivers such as rtsx_usb_ms, jmb38x_ms, tifm_ms, or r592 are affected. The CVE does not list specific kernel versions, indicating the flaw exists in every release that contains the unpatched source.

The CVSS score of 4.7 indicates moderate severity, the EPSS score is below 1 % and the vulnerability is not listed in CISA’s KEV catalog. Exploitation likely requires an external SD/USB device that drives the memstick subsystem; during the timeout, an attacker could force the host controller to finish the request after the timeout, causing a writing to freed memory. While the CVE description does not state a confirmed privilege escalation, kernel memory corruption can be leveraged by an attacker with sufficient skill to gain higher privileges or crash the system.