CVE-2026-90336serial: core: clear freed pointers on uart_register_driver() failure
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: serial: core: clear freed pointers on uart_register_driver() failure uart_register_driver() leaves drv->state pointing to freed memory when tty_alloc_driver() fails. If tty_register_driver() fails, drv->tty_driver also retains a pointer after its reference is dropped. Drivers that use drv->state as an "already registered" flag can then skip registration on the next probe and pass the freed state to uart_add_one_port(). This issue was found with failslab on QEMU's raspi1ap board by failing registration and binding the PL011 port again. Clear both pointers on their failure paths, as uart_unregister_driver() already does.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before ddf51d74ee9f9857c99477329d80408cedebda61; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 06b376432974fe5f25f2843a8e8438c6a1cf3d50; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 61a2fb25551be0375bc16ef2a70c987dfca26183 | CNA record |
References
- https://git.kernel.org/stable/c/ddf51d74ee9f9857c99477329d80408cedebda61
- https://git.kernel.org/stable/c/06b376432974fe5f25f2843a8e8438c6a1cf3d50
- https://git.kernel.org/stable/c/61a2fb25551be0375bc16ef2a70c987dfca26183
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.