A race condition exists between the caif_serial ldisc_close() routine and packet transmission, allowing a use‑after‑free of the tty structure. When a packet is transmitted while the device is closing, the freed tty reference may be accessed, causing a dangling pointer to be dereferenced. This enables arbitrary writes to kernel memory, potentially leading to a system crash or privilege escalation. The flaw is a classic Use‑After‑Free (CWE‑364).

The vulnerability resides in the Linux kernel caif_serial driver. Any kernel that includes caif serial support and has not yet incorporated the patch is affected. The fix is carried in recent stable releases; kernels prior to that fix remain vulnerable. All architectures running Linux with the caif network device enabled are subject to this risk.

The EPSS score is reported as < 1 %, and the CVE is not listed in the CISA KEV catalog. The most probable attack vector is local: an intruder would need to trigger a transmission on a caif serial interface while simultaneously closing the interface to create the race window. The race window is brief and timing‑dependent, making exploitation non‑trivial. Nonetheless, if successful the kernel may experience memory corruption and potentially allow privilege escalation.