A local race condition vulnerability in the Linux kernel parport subsystem allows low-privileged users to trigger kernel memory corruption and potential system crashes.

This is a race condition flaw (CWE-362) within the parport subsystem where port devices are registered before they are fully initialized, enabling client drivers like lp to attach prematurely. An authenticated local attacker with low privileges can exploit this to achieve high impacts on confidentiality, integrity, and availability.

Successful exploitation of this flaw can lead to kernel panics, resulting in denial of service and unplanned system downtime for critical infrastructure. Furthermore, kernel-level race conditions can potentially allow privilege escalation or memory disclosure, compromising the confidentiality and integrity of hosted data. The CVSS score of 7.8 reflects the high severity of achieving complete system compromise locally, even though physical or local access is required to initiate the attack vector.

Immediate Action: Update the Linux kernel to the patched versions, specifically version 5.10.259, 5.15.210, 6.1.176, 6.6.143, or later as appropriate for your distribution branch.

Proactive Monitoring: Monitor system logs for kernel panics, segmentation faults, or recurring module loading failures related to parport and parallel port drivers.

Compensating Controls: Restrict local shell access and module loading capabilities to trusted administrative personnel to prevent unauthorized users from triggering vulnerable module race conditions.

Public Exploit Available: No (false / unknown)

Administrators managing systems utilizing parallel port drivers should prioritize applying the latest upstream kernel patches or vendor-supplied updates. Because this vulnerability requires local execution capability, securing local user access combined with prompt kernel patching remains essential to mitigate the risk of denial of service and kernel instability.