CVE-2026-90336

serial: core: clear freed pointers on uart_register_driver() failure

State: Published
Severity: Not scored
Published: Sep 17, 2026
Updated: Oct 30, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

serial: core: clear freed pointers on uart_register_driver() failure

uart_register_driver() leaves drv->state pointing to freed memory when tty_alloc_driver() fails. If tty_register_driver() fails, drv->tty_driver also retains a pointer after its reference is dropped.

Drivers that use drv->state as an "already registered" flag can then skip registration on the next probe and pass the freed state to uart_add_one_port().

This issue was found with failslab on QEMU's raspi1ap board by failing registration and binding the PL011 port again.

Clear both pointers on their failure paths, as uart_unregister_driver() already does.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 5e260edd28eddc3b92c9f578df3026fd11c710cfAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before a9c0ffe5930c97b352f32febfc59a6e6ae6772eeAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 802e2192a9d38027730c2869c67c9131b8c8fe9fAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before ddf51d74ee9f9857c99477329d80408cedebda61Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 06b376432974fe5f25f2843a8e8438c6a1cf3d50Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 61a2fb25551be0375bc16ef2a70c987dfca26183Affected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.18.57 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 5e260edd28eddc3b92c9f578df3026fd11c710cfAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before a9c0ffe5930c97b352f32febfc59a6e6ae6772eeAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 802e2192a9d38027730c2869c67c9131b8c8fe9fAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before ddf51d74ee9f9857c99477329d80408cedebda61Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 06b376432974fe5f25f2843a8e8438c6a1cf3d50Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 61a2fb25551be0375bc16ef2a70c987dfca26183Affected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.18.57 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.