CVE-2026-90337: serial: core: do fallible allocations before the console can be registered
In the Linux kernel, the following vulnerability has been resolved:
serial: core: do fallible allocations before the console can be registered
serialcoreaddoneport() allocates uport->ttygroups after uartconfigureport(), which may register the console. If the allocation fails, the driver unwinds the port while its console remains registered. The earlier uport->name allocation has a related failure path that leaves state->uartport linked to a port being freed.
Failslab reproduced a NULL dereference in PL011 console output and a KASAN use-after-free in i.MX console output after failed binds.
Allocate the name and ttygroups before linking the port and configuring it. Reserve space for the optional driver attribute group because configport() may populate uport->attrgroup during configuration.
Affected Software
Event History
Frequently Asked Questions
What condition triggers the unsafe cleanup path?
An allocation failure while adding a serial port can trigger it. The affected allocations are uport->name and uport->tty_groups, and the failure can occur after console registration or port linkage in the vulnerable ordering.
Which console environments have demonstrated impact?
Failed binds reproduced a NULL dereference during PL011 console output and a KASAN use-after-free during i.MX console output. The issue concerns serial ports that may be configured as consoles.
How might an affected system present the problem?
Look for failures following a serial-port bind failure, especially a NULL dereference in PL011 console output or a KASAN use-after-free in i.MX console output. The vulnerable cleanup can leave a console registered for a port that is being freed, or leave state->uart_port linked to freed memory.