The Linux kernel nvmem core had multiple error path bugs where __nvmem_device_put() was called, potentially freeing the underlying memory and resources, but subsequent code continued to use the now-freed nvmem structure. The fix ensures that the reference to the nvmem device is released as the final step before returning an error code, preventing use-after-free conditions. This vulnerability is identified as CWE-416 and carries a CVSS 3.1 vector indicating local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Exploitation of this use-after-free vulnerability could allow an attacker with local access and low privileges to cause memory corruption, potentially leading to arbitrary code execution or system crashes. The impact affects confidentiality, integrity, and availability of the affected system components.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no explicit patch or vendor advisory is provided, users should monitor official Linux kernel updates and apply fixes once available to address this use-after-free vulnerability.