The Linux kernel interconnect subsystem had a use-after-free vulnerability in the functions icc_get() and of_icc_get_by_index(). When dynamic allocation of path->name via kasprintf() fails, the error path incorrectly calls kfree(path) directly, despite the path's requests already being linked into interconnect nodes' req_list. This leaves dangling pointers in the hlist, causing slab use-after-free errors when subsequent calls traverse or modify these corrupted lists. The fix replaces kfree(path) with icc_put(path), which safely removes requests from the req_list and drops provider usage references before freeing memory. Additionally, icc_lock mutex is released before calling icc_put(path) to prevent deadlocks.

This vulnerability can lead to kernel memory corruption due to use-after-free conditions, potentially causing system crashes or instability. There is no indication of known exploits in the wild. The impact is limited to kernel stability and security, with no direct evidence of privilege escalation or remote code execution.

A fix is available and has been applied in the Linux kernel source. The vulnerability is resolved by replacing the improper kfree(path) call with the proper icc_put(path) teardown function and ensuring correct mutex handling to avoid deadlocks. Users should update to the fixed kernel version once available. No additional mitigation is required beyond applying the official fix.