A use-after-free vulnerability in the Linux kernel lp8727 power supply driver could allow a local attacker to achieve system compromise or trigger a kernel panic.

The flaw resides in the lp8727_release_irq function, where the incorrect order of operations allows a threaded IRQ handler to re-arm delayed work after the associated memory has been released. This condition, requiring no authentication, permits a potential use-after-free scenario when the driver is removed.

The vulnerability carries a CVSS score of 8.4, reflecting its potential for full system impact if successfully exploited. A successful attack could lead to arbitrary code execution, unauthorized data access, or a complete system crash, resulting in significant operational disruption and the potential compromise of sensitive kernel-level data.

Immediate Action: Update the Linux kernel to version 6.12.109, 6.18.50, 7.2.4, or later, as provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel oops or segmentation faults, particularly when hardware drivers are being initialized or removed.

Compensating Controls: Restrict local access to systems running the affected kernel versions to minimize the threat surface, as this exploit requires local execution.

Public Exploit Available: Unknown.

Given the high severity of this kernel-level vulnerability, administrators should prioritize patching as part of the standard maintenance cycle. Although local access is required for exploitation, the risk of privilege escalation and system instability necessitates prompt application of the upstream fixes provided in the stable kernel branches.