In the Linux kernel USB serial subsystem, a use‑after‑free flaw exists during the tear‑down of serial ports. The driver deregisters and frees port state data while asynchronous completion handlers may still access that memory. A NULL check alone does not prevent a race, so a completed handler can dereference freed data, corrupting kernel memory and potentially crashing the system.

All Linux kernel versions that contain the unpatched USB serial driver code are affected. The vendors are Linux:Linux; specific affected releases are any kernel releases that have integrated the vulnerable driver implementation prior to the patch described in the commit logs.

The EPSS score is lower than 1 % and the flaw is not listed in CISA KEV, suggesting a low probability of exploitation. The attack requires local access to the machine, typically by connecting a malicious USB serial device or emulating one, to trigger the race condition. Successful exploitation could lead to a kernel panic, causing denial of service or setting the stage for privilege escalation if the crash can be leveraged. The CVSS score of 4.7 indicates moderate severity, warranting timely patching of vulnerable systems.