Executive brief
A vulnerability in the Linux kernel's DECstation DZ serial driver can cause a system crash during the initialization of serial ports. This occurs when the system attempts to access a memory address derived from a null pointer, leading to a kernel panic. While this primarily affects older hardware architectures like DECstations, it results in a complete loss of system availability during the boot process.
Technical details
A null pointer dereference exists in the DECstation DZ serial driver (drivers/tty/serial/dz.c) during the initialization of the first serial port. The crash occurs in `serial_base_ctrl_add` when a pointer is dereferenced that was derived from a null parent device pointer during legacy probing. The vulnerability is triggered during the `dz_init` call chain when `serial_core_register_port` is invoked. The fix involves converting the driver to use the platform device model, ensuring a valid parent device is associated with the port before registration. This issue was introduced by changes in serial controller management for runtime power management.
Affected products
- Linux Linux Kernel 6.19.0-dirty, 6.10 and earlier
Timeline
- 2026-05-06: patched: Fix authored by Maciej W. Rozycki
- 2026-07-19: disclosed: CVE published
References
- https://git.kernel.org/stable/c/2ff0401ffddaccc85f758c8259912d686d052b31
- https://git.kernel.org/stable/c/5c9fb95c8d6430d11dbb7b44fbe23222585cda86
- https://git.kernel.org/stable/c/5d7a49d60b8fda66da60e240fd7315232fa1754f
- https://git.kernel.org/stable/c/6f59646229490a93cda950017ad4bdfbfe770a1d
- https://git.kernel.org/stable/c/c9e78361fe92fb64662fc3c8f34e2cdbb8c25bc6