The Linux kernel's USB legousbtower driver had a use-after-free vulnerability caused by improper handling of mutex_unlock(). Unlike spinlocks and refcounts, mutex_unlock() can access the mutex structure after unlocking, making it unsafe to manage object lifetimes directly. This flaw could cause a race condition between the release() and disconnect() functions, potentially leading to use-after-free errors. The vulnerability was addressed by switching to a kref-based mechanism to manage driver data release safely, eliminating the unsafe access pattern.

The vulnerability could lead to use-after-free conditions in the Linux kernel USB driver, which may cause system instability or crashes. No known exploits in the wild have been reported. The impact is limited to kernel-level USB driver operations involving the legousbtower device.

A fix has been implemented in the Linux kernel by replacing mutex_unlock()-based lifetime management with a kref-based approach. Users should apply the official Linux kernel updates that include this patch. Since no explicit patch links or vendor advisories are provided, check the Linux kernel mailing lists or official repositories for the relevant commit and update accordingly.