A high-severity use-after-free vulnerability in the Linux kernel rt9455 power supply driver could allow a local attacker to achieve arbitrary code execution or system instability.

The vulnerability exists within the rt9455 power supply driver, where delayed work items can be queued after the driver has initiated a teardown or following a probe failure. This results in a use-after-free condition when the work-queue attempts to dereference the freed rt9455_info structure, which can be triggered by a local, unauthenticated user.

Successful exploitation of this vulnerability can lead to kernel-level memory corruption, potentially resulting in a denial of service (system crash) or the escalation of privileges to the kernel level. Given the CVSS score of 8.4, the risk to system integrity and availability is significant, particularly in environments where local access is provided to untrusted users or processes.

Immediate Action: Update the Linux kernel to version 6.12.109, 6.18.50, 7.2.4, or later, as these releases contain the necessary patches to correctly quiesce delayed work items.

Proactive Monitoring: Monitor system logs for kernel oops or panic messages associated with the rt9455 driver, which may indicate an attempt to trigger this use-after-free condition.

Compensating Controls: If patching is not immediately feasible, restrict access to the affected hardware driver or disable the rt9455 module if it is not required for system operation to reduce the attack surface.

Public Exploit Available: No

This vulnerability represents a critical risk to kernel stability and security. Administrators should prioritize patching the kernel across all affected Linux distributions, as the fix is readily available in the specified stable releases. Failure to update may leave systems susceptible to local privilege escalation or unexpected service disruption.