In Linux kernel devices, a race condition between tty ioctls and hangup can result in a NULL-pointer dereference if a serial device is disconnected during lengthy break signalling. The flaw is mitigated by serialising callbacks and adding checks before accessing driver data or hardware. An exploit that reaches this state would crash the kernel, causing a system reboot or other interruption of services. The vulnerability does not provide privilege escalation or data disclosure, but it can affect availability for the affected host. The flaw is a classic null pointer dereference race that could lead to a kernel panic.

All Linux kernel implementations that have not yet incorporated the commit that introduces this guard. The flaw applies to the generic Linux kernel and is present in any distribution that ships with the affected kernel before the fix is applied, regardless of release version. No specific version numbers are listed in the advisory, so all kernels lacking the patch are considered vulnerable.

The CVSS score is not publicly disclosed, and EPSS data is not available, so the exploitation probability is undefined. However, the issue is a local denial of service that requires the attacker to trigger a tty ioctl on a disconnected serial device, which typically needs the ability to run commands on the same machine and may be limited to users with sufficient privileges to access the serial port. The vulnerability is not currently listed in the CISA KEV catalogue. Given the lack of remote exploitation vectors and limited privilege requirements, the overall risk is moderate, but any kernel crash can have severe operational impacts. Applying the patch to the kernel mitigates the race condition and eliminates the crash path.