The flaw exists in the Linux Kernel's serial core driver. During port teardown the code can call serial_core_unregister_port() with a NULL port_dev pointer. The function then passes that NULL pointer to serial_core_get_ctrl_dev() which dereferences it, causing a kernel error that can crash the system. This dereference is not guarded, which allows an attacker able to trigger a registration failure or teardown to arbitrarily crash the kernel.

All Linux kernel installations that include the serial core driver are potentially affected. The vulnerability is addressed in recent mainline releases; the relevant commit references are linked in the advisory. No explicit version list is provided, so any kernel older than the patch is considered vulnerable.

The CVSS score is 4.4, the EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited exploitation evidence to date. Exploitation requires local access capable of inducing a tear‑down of a serial port without a registered device, which could lead to a kernel crash and potentially privilege escalation if code execution is already possible. The risk is therefore moderate and warrants immediate remediation.