Executive brief
The Linux kernel's xHCI debug TTY driver has a memory safety issue that can occur if the TTY driver registration fails during module initialization. When this happens, the kernel retains a dangling pointer to freed memory, which later gets dereferenced during module unload, potentially causing a kernel crash or memory corruption.
Technical details
This is a use-after-free vulnerability in the xhci-dbgtty driver (drivers/usb/host/xhci-dbgtty.c). When tty_register_driver() fails in dbc_tty_init(), the function calls tty_driver_kref_put() to release the reference and free the driver object, but fails to set the global dbc_tty_driver pointer to NULL. On module unload, dbc_tty_exit() checks only whether dbc_tty_driver is non-NULL (which it still is, pointing to freed memory) before calling tty_unregister_driver(), causing a use-after-free. The fix is a single line: setting dbc_tty_driver = NULL after the failed registration. The vulnerability affects kernels v5.10 and later, and is triggered locally during module unload if TTY registration fails during init. No network access or authentication is required.
Affected products
- Linux Linux kernel v5.10 and later
Timeline
- 2026-09-09: disclosed: Published on NVD
- 2026-09-02: patched: Fix merged into stable kernel branches by Greg Kroah-Hartman