A race condition in the Linux kernel's tty driver allows a use‑after‑free when vcc_cleanup clears port->tty without holding port->lock. The flaw, classified as CWE‑825 Improper Locking, can lead the system to access freed memory, which might cause crashes or, in the worst case, memory corruption that an attacker could exploit if they can trigger the race. The official description does not state a confirmed exploitation vector, but the use‑after‑free nature of the flaw is the critical impact.

The kernel code that contains this flaw is part of the VCC subsystem in the tty driver. All official Linux kernel releases that include the pre‑patch code are vulnerable. The vendor list identifies the kernel itself; distribution‑specific packages that ship the Linux kernel before the corrective commit are likewise affected. No specific kernel versions are enumerated in the advisory.

The CVSS score of 7.0 indicates medium severity, while the EPSS score of less than 1% suggests a very low exploitation probability. The flaw is not listed in the CISA KEV catalog, and no publicly documented exploits are referenced. The race condition appears to require local code or kernel module activity that can trigger VCC events; the vulnerability is likely exploitable only when an attacker can control such local processes.