The Linux kernel's powerz hardware monitoring driver contained a use-after-free vulnerability triggered on USB disconnect events. After powerz_disconnect() frees the URB and releases the mutex, a subsequent powerz_read() call could reacquire the mutex and call powerz_read_data(), which dereferences the now freed URB pointer, causing a use-after-free. The vulnerability was addressed by setting priv->urb to NULL in powerz_disconnect() to signal disconnection, adding a check in powerz_read_data() to return an error if the device is disconnected, and adjusting the order of usb_set_intfdata() to ensure the disconnect handler can always find the private data pointer. This flaw affects Linux kernel versions prior to 6.8.0-1064.72 and related builds. The vulnerability has a CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating local attack vector with low complexity and partial privileges required, leading to high impact on confidentiality, integrity, and availability. A patch is available and included in updated kernel packages.

Successful exploitation of this use-after-free vulnerability could allow a local attacker with limited privileges to cause memory corruption, potentially leading to system compromise with high impact on confidentiality, integrity, and availability. The vulnerability arises from dereferencing freed memory, which can cause crashes or arbitrary code execution within the kernel context.

A patch is available and should be applied by updating the Linux kernel to versions 6.8.0-1064.72 or later (and corresponding fixed versions listed). The vendor advisory from Ubuntu confirms that this issue is fixed in these updated kernel packages. After updating, a system reboot is required to apply the changes. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be necessary. Follow the vendor's update instructions carefully.