The Linux kernel ucs1002 power supply driver had a use-after-free vulnerability due to the absence of a remove callback. The alert IRQ handler queues delayed work (health_poll) that reschedules itself while the chip reports a bad-health condition. The devm-managed resources free the alert IRQ, synchronizing the handler but not cancelling the delayed work, which may run after driver data is freed, causing use-after-free. The fix registers health_poll with devm_delayed_work_autocancel before requesting the alert IRQ, ensuring the IRQ is freed before the delayed work is cancelled, preventing the handler from queuing work after data is freed. This vulnerability was discovered via an in-house static analysis tool.

Exploitation of this vulnerability could lead to use-after-free conditions in kernel space, potentially causing kernel crashes or undefined behavior. However, no known exploits are reported in the wild. The impact is limited to the affected driver and could affect system stability or security if triggered.

A fix is available that properly registers the delayed work with devm_delayed_work_autocancel to ensure cancellation before freeing driver data. Users should apply the official Linux kernel update that includes this patch. No additional mitigation is required beyond applying the fix.