A use-after-free vulnerability in the Linux kernel at91_udc driver could allow a local attacker to achieve code execution or system instability by triggering a race condition during driver removal.

The vulnerability is a use-after-free flaw within the at91_udc gadget driver. It occurs because the driver fails to cancel a self-restarting polled-VBUS timer cycle during teardown, leading the kernel to dereference memory associated with a freed UDC structure. This requires local access with low privileges to trigger.

The flaw is rated with a CVSS score of 7.8, reflecting its potential for a local attacker to compromise the integrity, availability, and confidentiality of the host system. Successful exploitation could lead to kernel-level code execution, resulting in a full system compromise, data theft, or denial of service that requires a hard reboot.

Immediate Action: Update the Linux kernel to version 6.12.109, 6.18.50, 7.2.4, or later to incorporate the necessary fix.

Proactive Monitoring: Monitor system logs for kernel oops or panic messages associated with the at91_udc driver, which may indicate attempted exploitation or unexpected driver state failures.

Compensating Controls: Restrict access to the system to only authorized local users, as this vulnerability requires local privileges to exploit. Disable the at91_udc module if it is not required for the specific hardware configuration.

Public Exploit Available: No (exploit_available: false)

Given the potential for kernel-level impact, administrators should prioritize patching affected systems. Apply the upstream kernel fixes as soon as they are integrated into your distribution's stable release cycle to mitigate the risk of local privilege escalation.