In the Linux kernel, the race condition occurs when a TTY device is re‑registered using a reused minor number while another process is closing the device and saving its termios state. If the re‑registration takes place before the old state is cleared, a use‑after‑free can happen. This memory corruption can potentially lead to local code execution or privilege escalation on systems that rely on the affected TTY drivers.

All Linux kernel implementations that employ TTY drivers lacking the TTY_DRIVER_RESET_SAVED_TERMIOS flag and that allow a minor number to be reused for a different device are at risk. The vulnerability applies across all distributions running kernel versions without the applied fix and does not depend on a specific configuration or kernel feature set.

Despite the EPSS score being very low (<1%) and the vulnerability not appearing in CISA's KEV catalog, the CVSS score of 4.7 indicates a moderate severity for this use‑after‑free flaw. A local attacker with sufficient privileges could trigger the race condition during TTY device registration and closing, leading to memory corruption and potentially local privilege escalation. The attack vector is local and requires the attacker to be able to open or otherwise interact with a TTY device on the affected system. Until the fix is applied, the risk remains of exploiting the race condition to gain unauthorized access.