A high-severity use-after-free vulnerability in the Linux kernel mcp2221 driver could allow a local authenticated attacker to achieve system compromise or cause a kernel panic.

The vulnerability exists in the mcp2221 HID driver due to a failure to clear the rxbuf pointer after an I2C/SMBus transfer completes or times out. This creates a dangling pointer that can be exploited by a local user with low privileges to trigger a write use-after-free, allowing device data to be copied into freed memory.

Successful exploitation of this vulnerability allows an attacker to manipulate kernel memory, which can lead to privilege escalation, unauthorized data access, or system instability. With a CVSS score of 7.8, this flaw represents a significant risk to the integrity and availability of server and workstation environments, as it allows for the subversion of kernel-level security boundaries.

Immediate Action: Update the Linux kernel to version 6.18.51, 7.2.4, or later versions where the fix has been backported.

Proactive Monitoring: Monitor system logs for kernel oops or unexpected crash reports related to the hid_mcp2221 module.

Compensating Controls: Restrict access to HID devices and kernel interfaces to only authorized users, and implement kernel self-protection features such as KASAN to detect memory corruption issues during development and testing.

Public Exploit Available: Unknown.

Given the potential for privilege escalation and kernel-level memory corruption, organizations should treat this vulnerability with high priority. Administrators should audit their Linux environments for the presence of the affected mcp2221 driver and apply the necessary kernel updates immediately to mitigate the risk of local exploitation.