The Linux kernel does not restore the TTY_IO_ERROR flag when a TTY port activation fails, creating a race condition that allows I/O operations to target a port that is deregistered or powered down. If such access occurs, the kernel may attempt to dereference a NULL pointer or read uninitialized memory during a hung or open ioctl, leading to a kernel panic. The flaw also resembles a use‑after‑free scenario because the flag is not reset before the port is closed, leaving a vulnerability window for a kernel crash.

All builds of the Linux kernel that lack the recent tty_port TTY_IO_ERROR restoration patch are affected. No specific version numbers are listed, so any kernel prior to the inclusion of the fix is vulnerable. Systems running a native Linux kernel without the update are at risk.

The vulnerability has a CVSS score of 4.7, indicating moderate severity, and its EPSS score is less than 1%, suggesting a very low but nonzero likelihood of exploitation. It is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is local; a privileged or root user can provoke the race condition by manipulating TTY device nodes, potentially leading to a kernel crash.