UBUNTU-CVE-2026-98747: Null Pointer Dereference
In the Linux kernel, the following vulnerability has been resolved: serial: core: fix NULL pointer dereference in serialcoreunregisterport() port->portdev is NULL when no port device is installed: it is cleared on teardown, and never set if registration failed before serialcoreportdeviceadd(). serialcoreunregisterport() passes it straight to serialcoregetctrldev(), which dereferences it: KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047] RIP: serialcoreunregisterport Call Trace: serial8250unregisterport serial8250remove unbindstore Return early when there is no port device, and read port->portdev under portmutex. Also clear port->portdev on the serialcoreregisterport() error path, where the port device has already been removed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Update the serial core error and unregister paths so serial_core_register_port() clears port->port_dev when the port device has already been removed, and serial_core_unregister_port() reads port->port_dev under port_mutex and returns early when no port device is installed.