The flaw creates a race between tty break ioctl calls and a hangup event, causing the kernel to invoke driver callbacks after the terminal device has been removed or powered down. This can lead to kernel panic or memory corruption, disrupting system availability. The text specifically advises that drivers abort TCSBRK and TCSBRKP on hangup to prevent calling back into a driver after timeout or after the tty has been reopened. An attacker with local access to a tty can trigger the race by issuing a break ioctl followed by a hangup, potentially causing the kernel to crash or exhibit memory corruption.

All Linux kernel releases that contain the unpatched tty subsystem add‑on. The CPE indicates the kernel package for Linux, meaning any kernel older than the fixed revision is affected. No specific version list is supplied, so administrators should verify that they are running the most recent stable kernel that incorporates this fix.

The CVSS score is 5.5 and the EPSS score is < 1%, indicating a moderate severity and low but non‑zero exploitation probability. It is not listed in the CISA KEV catalog. The vulnerability hinges on a local race condition that could crash the kernel or allow code execution. An attacker needs local access to a tty device; if such access is available, they can trigger the race by issuing a break ioctl followed by a hangup. The fix only requires updating the kernel, so the exploitation window closes once the patch is applied.