The vulnerability resides in the tlclk driver of the Linux kernel. A missing owner field in the file_operations structure allows the module to be unloaded while user‑space processes are still accessing the device. Additionally, tlclk_cleanup() frees alarm_events memory before waking blocked readers or deleting switchover_timer, creating a race that can lead to a use‑after‑free and kernel memory corruption. If exploited, an attacker could corrupt critical kernel data, potentially leading to denial of service or privilege escalation.

The flaw is present in the generic Linux kernel source for the tlclk driver. Any Linux system that builds its kernel with this driver enabled and which has not incorporated the upstream patch or a vendor‑supplied update is vulnerable. The issue is not limited to a specific distribution; it applies to all Linux kernel installations that include the untampered tlclk module.

The CVSS score of 7.8 classifies the vulnerability as high severity. The EPSS score is under 1%, indicating a low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. It is inferred that the attacker would need local, privileged access to unload the module or otherwise interact with the device to trigger the race, making the attack vector local. No public exploit chain is documented in the CVE description.