CVE-2026-90336: serial: core: clear freed pointers on uart_register_driver() failure
In the Linux kernel, the following vulnerability has been resolved:
serial: core: clear freed pointers on uartregisterdriver() failure
uartregisterdriver() leaves drv->state pointing to freed memory when ttyallocdriver() fails. If ttyregisterdriver() fails, drv->ttydriver also retains a pointer after its reference is dropped.
Drivers that use drv->state as an "already registered" flag can then skip registration on the next probe and pass the freed state to uartaddoneport().
This issue was found with failslab on QEMU's raspi1ap board by failing registration and binding the PL011 port again.
Clear both pointers on their failure paths, as uartunregisterdriver() already does.
Affected Software
Event History
Frequently Asked Questions
Under what conditions can this issue be triggered?
It requires uart_register_driver() to fail during driver registration, either because tty_alloc_driver() fails or because tty_register_driver() fails. A subsequent probe or rebind of a UART driver that treats drv->state as an already-registered flag can then use the stale freed state.
Which systems or drivers are most relevant for triage?
Systems using Linux kernel UART drivers are relevant where driver registration can fail and the driver may later be reprobed or rebound. The issue was found on QEMU's raspi1ap board by failing registration and binding the PL011 port again.
How can administrators determine whether they may have encountered the problem?
Look for a failed UART driver registration followed by a reprobe or rebind of the affected serial port driver. The vulnerable behavior involves drv->state or drv->tty_driver retaining pointers after their underlying objects have been freed.
What is the remediation?
Apply a kernel version containing the referenced fixes. The fix clears drv->state when tty_alloc_driver() fails and clears drv->tty_driver when tty_register_driver() fails, matching the cleanup performed by uart_unregister_driver().