UBUNTU-CVE-2026-90336: Low severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: serial: core: clear freed pointers on uartregisterdriver() failure uartregisterdriver() leaves drv->state pointing to freed memory when ttyallocdriver() fails. If ttyregisterdriver() fails, drv->ttydriver also retains a pointer after its reference is dropped. Drivers that use drv->state as an "already registered" flag can then skip registration on the next probe and pass the freed state to uartaddoneport(). This issue was found with failslab on QEMU's raspi1ap board by failing registration and binding the PL011 port again. Clear both pointers on their failure paths, as uartunregisterdriver() already does.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In uart_register_driver() failure paths, clear drv->state after its state is freed and clear drv->tty_driver after its reference is dropped, preventing subsequent probes from using freed pointers.
Event History
Frequently Asked Questions
What conditions are needed to trigger this issue?
A UART driver's registration must fail, either while allocating the TTY driver or while registering it, and the driver must subsequently be probed again. The stale state pointer can cause the driver to skip registration and pass freed memory to uart_add_one_port().
Which systems are potentially affected?
The issue applies to the listed Ubuntu kernel packages: linux, linux-fips, linux-aws, linux-azure, linux-gcp, and their listed FIPS variants. Systems without UART drivers that can be reprobed after a registration failure are not described as reaching the affected path.
How can I tell whether the vulnerable path has been encountered?
Look for a UART driver registration failure followed by a later rebind or reprobe of the same UART port. The relevant failure paths are tty_alloc_driver() and tty_register_driver(), after which the driver's state or tty_driver pointer may remain stale.