CVE-2026-89740

serial: imx: serialize imx_uart_ports[] lifetime

State: Published
Severity: Not scored
Published: Sep 11, 2026
Updated: Oct 30, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

serial: imx: serialize imx_uart_ports[] lifetime

imx_uart_probe() publishes its devm-allocated port in imx_uart_ports[] before uart_add_one_port() because console setup uses the table. The entry is not cleared when adding the port fails or after removal, leaving a dangling pointer.

A sibling probe can register the shared console through that stale entry. This was reproduced under KASAN on QEMU mcimx6ul-evk by unbinding a sibling UART, unbinding the console UART and rebinding the sibling.

Keep the entry valid through uart_remove_one_port(), then clear it. Protect port addition and removal together with their table updates so sibling operations cannot interleave. Reject an occupied slot rather than clobbering an active port during a duplicate-line probe.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	dbff4e9ea2e83fda89143389bfb229cb29425a32 to before ce9c074868d5c8adfb0c72de4324138d6fa1a1a8Affected dbff4e9ea2e83fda89143389bfb229cb29425a32 to before a4acf2739434a014cdfc282175cffd3e35a97fa4Affected dbff4e9ea2e83fda89143389bfb229cb29425a32 to before abc17fd508a511669997e48f8b014d8aa043abdfAffected dbff4e9ea2e83fda89143389bfb229cb29425a32 to before 681696ae9e4a28bdf54893c807dfe4a6c08e30a5Affected dbff4e9ea2e83fda89143389bfb229cb29425a32 to before 28b932202fcdbeb2ef58d89ce4363f480433c234Affected dbff4e9ea2e83fda89143389bfb229cb29425a32 to before 7429dce56a73bc080a8c072edb167106f73a08aeAffected dbff4e9ea2e83fda89143389bfb229cb29425a32 to before 8b0b29fdcb47907ae0296b8fe829e918e05e300fAffected
LinuxLinux	2.6.27Affected before 2.6.27Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.109 through 6.12.Not affected 6.18.50 through 6.18.Not affected 7.2.4 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

dbff4e9ea2e83fda89143389bfb229cb29425a32 to before ce9c074868d5c8adfb0c72de4324138d6fa1a1a8Affected
dbff4e9ea2e83fda89143389bfb229cb29425a32 to before a4acf2739434a014cdfc282175cffd3e35a97fa4Affected
dbff4e9ea2e83fda89143389bfb229cb29425a32 to before abc17fd508a511669997e48f8b014d8aa043abdfAffected
dbff4e9ea2e83fda89143389bfb229cb29425a32 to before 681696ae9e4a28bdf54893c807dfe4a6c08e30a5Affected
dbff4e9ea2e83fda89143389bfb229cb29425a32 to before 28b932202fcdbeb2ef58d89ce4363f480433c234Affected
dbff4e9ea2e83fda89143389bfb229cb29425a32 to before 7429dce56a73bc080a8c072edb167106f73a08aeAffected
dbff4e9ea2e83fda89143389bfb229cb29425a32 to before 8b0b29fdcb47907ae0296b8fe829e918e05e300fAffected

LinuxLinux

2.6.27Affected
before 2.6.27Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.109 through 6.12.*Not affected
6.18.50 through 6.18.*Not affected
7.2.4 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.