CVE-2026-90335: tty: skip cdev_del() when no cdev is registered

Published Sep 17, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

tty: skip cdevdel() when no cdev is registered

TTY device registration can fail before a cdev is allocated. Serial core keeps the port so setserial can still use it, and later removal passes the NULL cdev slot to cdevdel(), causing a NULL-pointer dereference.

Only delete the cdev when the slot is not NULL.

Affected Software

1 affected component

Linux Linux kernel

Event History

Sep 17, 2026

CVE Published

via MITRE·04:08 PM

Data Sourced

via MITRE·04:08 PM

Description

Frequently Asked Questions

What conditions are required to trigger the NULL-pointer dereference?

TTY device registration must fail before a character device is allocated, while serial core retains the port for setserial use. A later removal of that port then passes the NULL cdev slot to cdev_del().

Is the affected port discarded when TTY registration fails?

No. Serial core keeps the port so that setserial can still use it, which allows the later removal path to encounter the missing cdev.

What is the mitigation if an update is not immediately available?

The provided information does not describe a workaround. The resolved behavior is to call cdev_del() only when the cdev slot is not NULL.