Executive brief
The Linux kernel's terminal device (tty) subsystem contains a use-after-free vulnerability in the character device registration code. When device registration fails, the code releases memory but leaves a stale pointer in a driver table. A later cleanup operation dereferences this freed pointer, potentially causing a kernel crash or undefined behavior that could affect system stability.
Technical details
The vulnerability is a use-after-free bug in the tty subsystem's tty_cdev_add() function in drivers/tty/tty_io.c. When cdev_add() fails, the code calls kobject_put() to drop the character device reference, but fails to clear the corresponding entry in the driver->cdevs[] array. Subsequently, tty_unregister_device() dereferences the stale pointer and passes it to cdev_del(), causing a use-after-free. The fix is minimal: after dropping the reference on failure, set driver->cdevs[index] = NULL to prevent the dangling pointer. No special privileges or network access are required—the vulnerability is triggered during normal tty device registration/unregistration sequences. A patch has been released clearing the pointer after kobject_put().
Affected products
- Linux Linux kernel multiple versions (see stable branches linux-2.6.11.y through linux-7.2.y and later)
Timeline
- 2026-09-17: disclosed
- 2026-09-14: patched: Upstream commit 6645856f0df3aeecd45519cb611415b4b89c2223 merged to stable branches