The bug arises from a use‑after‑free condition in the Linux kernel console code. When a console device is freed during an unlocked copy_from_user window, the pointer used after a failed write is stale and non‑NULL. This allows the notifier to read freed memory, triggering a KASAN report and potentially enabling arbitrary code execution or a kernel crash. The failure propagates through vcs_notifier and can be triggered by concurrent console activity. The primary impact is a severe compromise of kernel integrity and availability, with the potential for privilege escalation if an attacker can execute code at kernel level. The weakness is a classic use‑after‑free flaw, classified as CWE‑416.

The vulnerability affects Linux kernels that do not include the patch commit 8fb9ea65c9d1, which reloads the vc pointer immediately after console_lock. All distributions that ship earlier kernel releases are potentially impacted, regardless of vendor, because the fix is part of the mainline kernel source. Precise affected versions are not listed, but the issue is present in any kernel before the commit that updates vcs_write to reload the vc pointer before the return path.

The use‑after‑free flaw has a CVSS score of 4.7, indicating moderate severity. An attacker with local console access could induce the bug and potentially gain arbitrary code execution on the kernel. The EPSS score of 0.00168 (0.168%) indicates a low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. However, the critical nature of kernel code execution remains a concern; the likely attack vector involves manipulating console input during a write operation, causing the stale pointer condition. Immediate mitigation is still recommended.