The vulnerability in the Linux kernel edt-ft5x06 input driver was caused by a race condition where debugfs files remained accessible after the raw_buffer memory was freed, leading to a use-after-free condition (CWE-416). The root cause was the removal of manual debugfs teardown in favor of relying on the I2C core, which introduced a window where debugfs read operations could access freed memory. The patch protects the freeing of raw_buffer with a device mutex and sets raw_buffer to NULL, ensuring that debugfs read functions safely check for NULL before access, thus preventing use-after-free.

This vulnerability allows a local attacker with limited privileges to exploit a use-after-free condition, potentially causing memory corruption. The CVSS vector indicates high impact on confidentiality, integrity, and availability (C:H/I:H/A:H), meaning exploitation could lead to full system compromise or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves mutex protection and nullification of raw_buffer to prevent use-after-free. Users should monitor official Linux kernel advisories for patches addressing this issue and apply them promptly once available.