CVE-2023-53176

serial: 8250: Reinit port->pm on port specific driver unbind

State
Published
Severity
7.8 High
Published
Sep 15, 2025
Updated
Oct 15, 2026
Reserved
Sep 15, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

serial: 8250: Reinit port->pm on port specific driver unbind

When we unbind a serial port hardware specific 8250 driver, the generic serial8250 driver takes over the port. After that we see an oops about 10 seconds later. This can produce the following at least on some TI SoCs:

Unhandled fault: imprecise external abort (0x1406) Internal error: : 1406 [#1] SMP ARM

Turns out that we may still have the serial port hardware specific driver port->pm in use, and serial8250_pm() tries to call it after the port specific driver is gone:

serial8250_pm [8250_base] from uart_change_pm+0x54/0x8c [serial_base] uart_change_pm [serial_base] from uart_hangup+0x154/0x198 [serial_base] uart_hangup [serial_base] from __tty_hangup.part.0+0x328/0x37c __tty_hangup.part.0 from disassociate_ctty+0x154/0x20c disassociate_ctty from do_exit+0x744/0xaac do_exit from do_group_exit+0x40/0x8c do_group_exit from __wake_up_parent+0x0/0x1c

Let's fix the issue by calling serial8250_set_defaults() in serial8250_unregister_port(). This will set the port back to using the serial8250 default functions, and sets the port->pm to point to serial8250_pm.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • c161afe9759ddcc174d08e7c4f683d08ac9ba86f to before 490bf37eaabb0a857ed1ae8e75d8854e41662f1cAffected
  • c161afe9759ddcc174d08e7c4f683d08ac9ba86f to before c9e080c3005fd183c56ff8f4d75edb5da0765d2cAffected
  • c161afe9759ddcc174d08e7c4f683d08ac9ba86f to before d5cd2928d31042a7c0a01464f9a8d95be736421dAffected
  • c161afe9759ddcc174d08e7c4f683d08ac9ba86f to before 2c86a1305c1406f45ea780d06953c484ea1d9e6eAffected
  • c161afe9759ddcc174d08e7c4f683d08ac9ba86f to before 1ba5594739d858e524ff0f398ee1ebfe0a8b9d41Affected
  • c161afe9759ddcc174d08e7c4f683d08ac9ba86f to before af4d6dbb1a92ea424ad1ba1d0c88c7fa2345d872Affected
  • c161afe9759ddcc174d08e7c4f683d08ac9ba86f to before 8e596aed5f2f98cf3e6e98d6fe1d689f4a319308Affected
  • c161afe9759ddcc174d08e7c4f683d08ac9ba86f to before 04e82793f068d2f0ffe62fcea03d007a8cdc16a7Affected
LinuxLinux
  • 2.6.37Affected
  • before 2.6.37Not affected
  • 4.14.316 through 4.14.*Not affected
  • 4.19.284 through 4.19.*Not affected
  • 5.4.244 through 5.4.*Not affected
  • 5.10.181 through 5.10.*Not affected
  • 5.15.113 through 5.15.*Not affected
  • 6.1.30 through 6.1.*Not affected
  • 6.3.4 through 6.3.*Not affected
  • 6.4 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.