A critical use-after-free vulnerability in the Linux kernel serial driver can lead to system instability or arbitrary code execution, necessitating an immediate kernel update.

The vulnerability exists in the dw8250_probe function, where a failure in the clock notifier registration process leaves a serial port registered while associated driver data is freed. This results in a use-after-free condition when the port is subsequently accessed, and the issue is reachable by an unauthenticated attacker if they can trigger the probe failure.

The flaw carries a CVSS score of 9.8, reflecting its potential to cause full system compromise. Successful exploitation could lead to unauthorized code execution, system crashes, or escalation of privileges, posing a severe risk to data integrity and service availability for any infrastructure relying on affected Linux distributions.

Immediate Action: Update the Linux kernel to the patched versions (6.1.177, 6.6.144, 6.12.95, or 6.18.38) provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel oops or unexpected service restarts related to the 8250_dw serial driver.

Compensating Controls: Ensure that restricted physical or network access is enforced for systems utilizing the 8250_dw serial interface, as limiting interaction with vulnerable hardware drivers reduces the attack surface.

Public Exploit Available: No

This vulnerability represents a significant risk due to its potential for kernel-level impact and its Critical CVSS rating. Administrators should prioritize patching their Linux kernels as part of their regular maintenance cycle, focusing on systems that utilize the 8250_dw serial driver. Apply the recommended kernel updates immediately to eliminate this memory safety hazard.