A use‑after‑free flaw exists in the Linux kernel’s serial CAIF (Control and Adaptation Interface for FUSS) line discipline. The missing reference to tty->link during ldisc_open and ser_release causes a KASAN-detected UAF when caif_serial’s TX path invokes tty_write_room, potentially enabling an attacker to corrupt kernel memory or execute arbitrary code with elevated privileges. The weakness is a classic use‑after‑free error (CWE‑416) and involves memory reference misuse (CWE‑911).

The affected product is the Linux kernel. All kernel releases prior to the application of the fix that introduces an extra kref on tty->link are vulnerable. No specific version range is listed; any kernel containing the buggy caif_serial line discipline may be impacted.

No EPSS score is available, and the vulnerability is not listed in CISA KEV, but the nature of the flaw suggests a high impact if successfully exploited because it occurs in kernel space and can lead to arbitrary code execution. Without a CVSS score the exact severity is unknown, but the potential for kernel compromise warrants immediate attention. The likely attack vector involves interacting with a serial CAIF device (e.g., from user space), which could be achieved locally or remotely if the device is exposed over a network or shared environment.