Executive brief
The Linux kernel's 8250 serial port driver can crash with a "kernel paging request" error when a hardware-specific serial driver is unloaded. The crash occurs approximately ten seconds after unload when the system tries to change power management settings. This causes service disruption on systems relying on serial ports for console access, management interfaces, or critical device communication.
Technical details
The vulnerability is a null pointer dereference in the uart_change_pm() function within the 8250 serial driver. When a hardware-specific 8250 driver unbinds, the port->pm function pointer is not properly cleared; only port->ops is reinitialized. Later, when uart_change_pm() is called (e.g., during uart_hangup()), serial8250_pm() invokes the stale port->pm() pointer instead of the safe serial8250_do_pm() function, causing a kernel panic. The fix is a single-line change that explicitly sets port->pm to NULL during port initialization. The vulnerability affects systems using hardware-specific 8250 UART drivers and can be exploited by unloading and reloading the driver module.
Affected products
- Linux Linux kernel Multiple versions (patched in linux-6.5+)
Timeline
- 2023-08-04: disclosed
- 2023-08-23: patched