The Linux kernel tmp006 driver allocated a data-ready (DRDY) trigger using devm_iio_trigger_alloc() but registered it with iio_trigger_register(). Since the driver lacks a .remove() callback, unloading the module left the trigger registered globally while its memory was freed by devm, causing a dangling pointer. The vulnerability was fixed by switching to devm_iio_trigger_register(), which ties the trigger registration lifecycle to the managed device scope, ensuring automatic unregistration and preventing dangling references.

This vulnerability could lead to a use-after-free condition when the tmp006 driver module is unloaded, potentially causing kernel instability or crashes. There is no evidence of known exploits in the wild. The impact is limited to kernel stability and reliability rather than direct privilege escalation or data leakage.

A fix is available that changes the trigger registration to devm_iio_trigger_register(), ensuring proper cleanup on module unload. Users should update to a Linux kernel version that includes this fix. Patch status is not explicitly confirmed in the provided data; check the vendor advisory or Linux kernel mailing lists for the exact fixed version and apply the official update.