The flaw lies in the brcmuart driver for BCM7271 UART chips, where a use‑after‑free condition occurs when brcmuart_remove cancels the hrtimer before unregistering the port, allowing a receive‑timeout interrupt to arrive after the timer has been cancelled but before the device is freed. The hrtimer callback then dereferences freed memory, corrupting kernel memory. This bug can crash the kernel or be leveraged by a local attacker to achieve kernel‑level privilege escalation.

All Linux kernel installations that include the brcmuart driver for BCM7271 chips and have not applied the accompanying patch. The issue is present in any kernel where the brcmuart_remove function cancels the hrtimer before unregistering the port. No specific kernel version is listed, so any affected device using this driver should consider the vulnerability.

The CVSS score is 4.1 and the EPSS score is < 1%, indicating a low probability of exploitation. The issue is not listed in the CISA KEV catalog. The likely attack requires local privileged access or control of the UART device to trigger a receive‑timeout interrupt between the cancellation of the hrtimer and the removal of the port. While remote exploitation is unlikely, local exploitation could lead to a kernel crash or privilege escalation.