The Linux kernel cros_ec driver had a use-after-free vulnerability caused by setting the device driver data pointer (dev_set_drvdata) before the probe function (ec_device_probe) completed successfully. If ec_device_probe failed, the cros_ec_dev structure memory was freed, but the stale pointer remained accessible via the platform device. Sub-drivers such as cros_ec_typec could then access this freed memory, causing use-after-free errors and potential kernel instability. The patch moves the dev_set_drvdata call to after successful initialization to prevent exposing stale pointers.

This vulnerability can lead to use-after-free conditions in the kernel, potentially causing kernel crashes, memory corruption, or undefined behavior when sub-drivers access freed memory. There is no indication of remote exploitability or privilege escalation in the provided data. No known exploits are reported in the wild.

A fix has been implemented in the Linux kernel to delay the dev_set_drvdata call until after the probe function completes successfully, preventing exposure of stale pointers. Users should update to the patched kernel version once available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.