CVE-2026-98747: serial: core: fix NULL pointer dereference in serial_core_unregister_port()
In the Linux kernel, the following vulnerability has been resolved:
serial: core: fix NULL pointer dereference in serialcoreunregisterport()
port->portdev is NULL when no port device is installed: it is cleared on teardown, and never set if registration failed before serialcoreportdeviceadd(). serialcoreunregisterport() passes it straight to serialcoregetctrldev(), which dereferences it:
KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047] RIP: serialcoreunregisterport Call Trace: serial8250unregisterport serial8250remove unbindstore
Return early when there is no port device, and read port->portdev under portmutex.
Also clear port->portdev on the serialcoreregisterport() error path, where the port device has already been removed.
Affected Software
Event History
Frequently Asked Questions
Under what conditions can this crash occur?
The crash can occur when serial_core_unregister_port() runs while port->port_dev is NULL. This can happen after teardown clears the port device, or when registration fails before serial_core_port_device_add() installs it.
Is interaction with a serial device driver involved?
Yes. The provided call trace shows serial8250_unregister_port() and serial8250_remove() leading to the vulnerable path, including removal through unbind_store.
What does the fix change?
The fix returns early if no port device is present and reads port->port_dev while holding port_mutex. It also clears port->port_dev on the serial_core_register_port() error path after the port device has been removed.