The vulnerability occurs in the Linux kernel’s 8250_dw serial driver when the probe function registers a serial port and attempts to register a clock notifier. If the notifier registration fails, the port remains registered while the driver’s private data is freed, leaving a reference to freed memory. This creates a use‑after‑free condition that could allow code execution or a denial‑of‑service. The weakness corresponds to CWE‑825 (Use‑After‑Free).

All releases of the Linux kernel that include the 8250_dw driver before the fix are vulnerable. The vulnerability applies to every distribution that ships a kernel containing this driver, regardless of the CPU architecture, until a patched kernel is installed. No specific version list is provided in the CVE data.

The CVSS base score of 9.8 indicates a very high severity. The EPSS score of <1% suggests that exploitation in the wild is unlikely at the present time. The vulnerability is not listed in the CISA KEV catalog. Attackers would need local or higher privileges to trigger the driver’s probe path, such as by loading or reloading the kernel module or rebooting the system. Based on the description, the likely attack vector is local and therefore confined to adversaries who can execute privileged code on the affected machine.