The Linux kernel's serial amba-pl011 driver had a flaw where RS485 trigger hrtimers embedded in the devm-managed port could fire after the port was freed. Since the IRQ handler could arm a timer, the fix involved freeing the IRQ before canceling both timers to prevent timers from firing post-free. Additionally, the RS485 stop process was completed without arming a timer, and timers were canceled in the remove() function for the suspend-then-unbind path where shutdown is not called. This vulnerability was discovered by an internal static analysis tool and has been resolved in the kernel.

The vulnerability could cause timers to fire after the associated device port was freed, potentially leading to use-after-free conditions or improper resource management in the kernel serial driver. This could affect system stability or reliability but no specific exploitation or impact details are provided.

A fix has been implemented in the Linux kernel to address this issue by properly ordering the freeing of IRQs and canceling of RS485 hrtimers. Users should update to the fixed kernel versions once available. Patch status is not explicitly confirmed in the provided data; check the official Linux kernel advisories or source repositories for the exact fixed versions and apply updates accordingly.