The vulnerability is a use‑after‑free issue in the Linux kernel USB serial subsystem. When a driver module is unloaded, the USB bus driver was deregistered after the serial bus drivers, allowing completion handlers to access freed port data. The fix ensures drivers are deregistered in the correct order and removes the new_id attributes before probing, preventing a malicious device from triggering a probe after the driver has been removed. This defect could lead to memory corruption if a malicious USB device is connected during module unload.

The flaw exists in the Linux kernel's USB serial subsystem. It affects all Linux distributions running kernel versions in which the bug was present, prior to the commit that fixed the deregistration order. The vendors affected are those that ship the Linux kernel, such as Red Hat, Ubuntu, Debian, SUSE, Fedora, and any custom kernel builds that incorporate this driver interface. No specific product names are listed beyond the kernel itself.

A local attacker with physical access to a USB port and the ability to load or unload kernel modules could exploit the use‑after‑free to cause a kernel crash or possibly elevate privileges. The lack of an EPSS score and absence from the KEV catalog suggest that exploitation is not widely observed, but the nature of a kernel memory corruption indicates a high impact if an exploit is crafted. The CWE involved is CWE‑416. Because the hardware interaction is required, the attack vector is local rather than remote. The vulnerability is mitigated by applying the kernel patch that reorders deregistration and removes new IDs before probing.