CVE-2026-90334: tty: clear cdev pointer after cdev_add() failure
In the Linux kernel, the following vulnerability has been resolved:
tty: clear cdev pointer after cdevadd() failure
ttycdevadd() drops the cdev reference when cdevadd() fails, but leaves driver->cdevs[index] pointing to freed memory. ttyunregisterdevice() later passes that stale pointer to cdevdel(), causing a use-after-free.
Clear the slot after dropping the reference.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the kernel fix that clears the stale tty cdev pointer (driver->cdevs[index]) after cdev_add() fails, so that tty_unregister_device() does not later pass a freed (stale) pointer to cdev_del().
Linux kernel tty: clear cdev pointer after cdev_add() failure = Implemented
Event History
Frequently Asked Questions
Is a failed device-registration path required for this issue to occur?
Yes. The stale pointer is left only when cdev_add() fails and tty_cdev_add() drops the cdev reference without clearing driver->cdevs[index]. A later tty_unregister_device() call can then pass that freed pointer to cdev_del().
What change prevents the use-after-free?
Clear driver->cdevs[index] after dropping the cdev reference following a cdev_add() failure. This prevents tty_unregister_device() from using the stale pointer later.