CVE-2026-90337

serial: core: do fallible allocations before the console can be registered

State: Published
Severity: Not scored
Published: Sep 17, 2026
Updated: Oct 30, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

serial: core: do fallible allocations before the console can be registered

serial_core_add_one_port() allocates uport->tty_groups after uart_configure_port(), which may register the console. If the allocation fails, the driver unwinds the port while its console remains registered. The earlier uport->name allocation has a related failure path that leaves state->uart_port linked to a port being freed.

Failslab reproduced a NULL dereference in PL011 console output and a KASAN use-after-free in i.MX console output after failed binds.

Allocate the name and tty_groups before linking the port and configuring it. Reserve space for the optional driver attribute group because config_port() may populate uport->attr_group during configuration.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	266dcff03eed0050b6af11aaf2a61ab837d7ba3f to before be61f56c4f0ed1cbf16c5f7b0dec6d6414993dd4Affected 266dcff03eed0050b6af11aaf2a61ab837d7ba3f to before e2ddbfd826836cba1b7a25ee4eb512f7d752b703Affected 266dcff03eed0050b6af11aaf2a61ab837d7ba3f to before 8c7c75bfa7b84d6999de2100ce9c09e3779249a0Affected 266dcff03eed0050b6af11aaf2a61ab837d7ba3f to before 9260a92ce90e6a95ce2ffdf1441c5216bf3f9552Affected 266dcff03eed0050b6af11aaf2a61ab837d7ba3f to before c2aec15f78b2e6ccd9b94216a901248511355982Affected 266dcff03eed0050b6af11aaf2a61ab837d7ba3f to before 1a0e4fbce5d9c1bc179a35a2fd9ed142664299e3Affected
LinuxLinux	3.17Affected before 3.17Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.18.57 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

266dcff03eed0050b6af11aaf2a61ab837d7ba3f to before be61f56c4f0ed1cbf16c5f7b0dec6d6414993dd4Affected
266dcff03eed0050b6af11aaf2a61ab837d7ba3f to before e2ddbfd826836cba1b7a25ee4eb512f7d752b703Affected
266dcff03eed0050b6af11aaf2a61ab837d7ba3f to before 8c7c75bfa7b84d6999de2100ce9c09e3779249a0Affected
266dcff03eed0050b6af11aaf2a61ab837d7ba3f to before 9260a92ce90e6a95ce2ffdf1441c5216bf3f9552Affected
266dcff03eed0050b6af11aaf2a61ab837d7ba3f to before c2aec15f78b2e6ccd9b94216a901248511355982Affected
266dcff03eed0050b6af11aaf2a61ab837d7ba3f to before 1a0e4fbce5d9c1bc179a35a2fd9ed142664299e3Affected

LinuxLinux

3.17Affected
before 3.17Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.18.57 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.