A high-severity use-after-free vulnerability in the Linux kernel tlclk driver exposes local systems to potential privilege escalation and denial of service.

The vulnerability exists in the tlclk driver due to improper module cleanup processes, specifically a lack of ownership tracking in file operations and premature memory deallocation in the tlclk_cleanup function. This allows a local, authenticated user to trigger a race condition, potentially leading to a use-after-free scenario.

Successful exploitation of this vulnerability could allow an attacker with local access to crash the system, resulting in significant downtime for critical services. Furthermore, use-after-free flaws often provide a pathway for local privilege escalation, potentially allowing an attacker to gain elevated administrative control over the affected host. Given the CVSS score of 7.8, this flaw represents a significant risk to the confidentiality, integrity, and availability of local system resources.

Immediate Action: Apply the latest stable kernel updates provided by your distribution vendor, ensuring the kernel is at least version 5.10.261, 5.15.212, 6.1.178, or 6.6.145.

Proactive Monitoring: Monitor system logs for kernel oops or panic messages that might indicate an attempt to trigger a use-after-free condition in the tlclk driver.

Compensating Controls: If patching is not immediately feasible, consider blacklisting the tlclk kernel module if it is not required for system operation to prevent the driver from being loaded.

Public Exploit Available: Unknown

Organizations should prioritize patching this kernel vulnerability as part of their standard maintenance cycle, particularly on multi-user systems where untrusted local users may have access. Testing the updated kernel versions in a staging environment is advised to ensure compatibility with existing hardware drivers before deploying to production systems.