A race condition between the ldisc_close() routine of the caif_serial driver and packet transmission can cause a use-after-free of the tty structure. If an attacker can trigger the race, the kernel may attempt to write through a dangling pointer, leading to arbitrary memory corruption. This type of flaw matches the classic Use-After-Free weakness (CWE-416) and can be leveraged for privilege escalation or denial of service.

The flaw resides in the Linux kernel caif_serial driver and affects any kernel configuration that includes caif serial support. The patch is applied through the kernel source tree and is available in recent stable releases; all earlier kernels that have not applied the corresponding commit are vulnerable.

There are no published CVSS or EPSS scores for this vulnerability, and it is not listed in the CISA KEV catalog. The attack vector appears to be local, requiring an attacker to control a process that can initiate data transmission on a caif serial interface while simultaneously closing the interface. Because the race window is brief and depends on precise timing, exploitation may be non-trivial, yet the potential impact is high if successful.