The Linux kernel’s amba‑pl011 serial driver contains a timing flaw: after the IRQ is freed, its RS485 high‑resolution timers may still fire. The IRQ handler can arm a timer, and if the timer runs after the port has been freed, it will reference deallocated memory, resulting in a use‑after‑free condition. This could lead to a kernel panic or provide a foothold for an attacker to execute code with kernel privileges, depending on the context and the payload executed by the timer. The vulnerability is explicitly identified as a race condition affecting timer cleanup logic.

All Linux kernel releases that include the amba‑pl011 driver and have not applied the fix are potentially impacted. An explicit list of vulnerable versions is not supplied; therefore any system using the default amba‑pl011 serial driver before the fix in the commit referenced by the advisory should be considered at risk.

The CVE report does not provide a CVSS score or EPSS data, nor is it listed in the CISA KEV catalog, indicating that detailed exploitation data is currently unknown. The flaw is a local kernel defect; external exploitation would require either physical proximity or a path to trigger RS485 traffic that arms timers. However, the inherent race condition and use‑after‑free nature of the bug present a high potential for system instability or privilege escalation if an attacker can invoke the buggy code path. Monitoring for kernel panics and planning for an update are advisable.