Executive brief
The Linux kernel's IMX UART serial driver maintains a shared table of active serial ports. A race condition caused the table to retain stale pointers after a port was removed or failed to initialize, allowing another driver probe to access and corrupt the entry. This could lead to kernel crashes or undefined behavior when managing multiple UART devices concurrently.
Technical details
The vulnerability is a use-after-free / dangling pointer issue in the IMX UART driver (drivers/tty/serial/imx.c). The imx_uart_probe() function published device pointers to a global imx_uart_ports[] table before the uart_add_one_port() call completed, but did not clear the entry on failure or during device removal, leaving dangling pointers. Concurrent sibling probes could race and register the shared console through the stale entry, corrupting active ports. The fix adds mutex serialization (imx_uart_ports_lock) around port table updates and removal, ensures entries are cleared after uart_remove_one_port(), and rejects duplicate-line probes that would clobber occupied slots. Network or local code execution is not directly exploitable; impact is kernel stability on systems with multiple UART devices undergoing hot-plug or reconfiguration.
Affected products
- Linux Linux Kernel affected versions not specified in advisory; fix commits available
Timeline
- 2026-09-11: disclosed: Published on NVD
- 2026-09-07: patched: Fixes committed to stable kernel by Greg Kroah-Hartman
- 2026-07-31: other: Patch authored by Karl Mehltretter