CVE-2026-90337serial: core: do fallible allocations before the console can be registered
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: serial: core: do fallible allocations before the console can be registered serial_core_add_one_port() allocates uport->tty_groups after uart_configure_port(), which may register the console. If the allocation fails, the driver unwinds the port while its console remains registered. The earlier uport->name allocation has a related failure path that leaves state->uart_port linked to a port being freed. Failslab reproduced a NULL dereference in PL011 console output and a KASAN use-after-free in i.MX console output after failed binds. Allocate the name and tty_groups before linking the port and configuring it. Reserve space for the optional driver attribute group because config_port() may populate uport->attr_group during configuration.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 266dcff03eed0050b6af11aaf2a61ab837d7ba3f before 9260a92ce90e6a95ce2ffdf1441c5216bf3f9552; from 266dcff03eed0050b6af11aaf2a61ab837d7ba3f before c2aec15f78b2e6ccd9b94216a901248511355982; 266dcff03eed0050b6af11aaf2a61ab837d7ba3f builds before 1a0e4fbce5d9c1bc179a35a2fd9ed142664299e3 | CNA record |
References
- https://git.kernel.org/stable/c/9260a92ce90e6a95ce2ffdf1441c5216bf3f9552
- https://git.kernel.org/stable/c/c2aec15f78b2e6ccd9b94216a901248511355982
- https://git.kernel.org/stable/c/1a0e4fbce5d9c1bc179a35a2fd9ed142664299e3
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.