The kernel function kbd_keycode reads the tty pointer from vc->port without taking a reference, racing against con_shutdown, which may clear the pointer under a different lock. This race condition can lead to a use‑after‑free or memory corruption scenario that could crash the kernel or, in a worst‑case scenario, allow a local attacker with access to the console or keyboard input to execute arbitrary code.

The vulnerability exists in the Linux kernel. No explicit version range is provided in the data, indicating that any Linux kernel compiled from source before the applied patch may be affected. The fix is present in the mainline source code, so upgrading to a recent stable kernel or backporting the specific commit will mitigate the issue.

The CVSS score is 7.8, the EPSS score is < 1%, and it is not listed in the CISA KEV catalog. The high severity and low exploitation probability suggest a significant threat level, but a race‑condition leading to use‑after‑free could still allow a local attacker to crash the kernel or potentially gain privilege. The likely attack vector remains local, via console or keyboard input. No public exploits are known yet.