Executive brief
The Linux kernel's TTY device driver subsystem can crash with a NULL pointer dereference when a device is being removed. This occurs when TTY device registration fails before allocating a character device; the kernel attempts to clean up a NULL pointer, causing an immediate system crash. Systems that hot-plug or regularly add/remove serial or terminal devices are at risk of denial of service.
Technical details
This is a NULL pointer dereference vulnerability in the TTY device unregistration path (drivers/tty/tty_io.c). The root cause is that TTY device registration can fail before a character device (cdev) is allocated, yet the driver slot remains reserved for later use by setserial. When device removal is triggered via tty_unregister_device(), the code unconditionally passes the NULL cdev pointer to cdev_del(), triggering a crash. The fix adds a NULL check: only call cdev_del() if driver->cdevs[index] is non-NULL. No elevated privileges or network access are required; any local user with the ability to trigger device removal (typical in container or hot-plug scenarios) can cause a kernel panic, resulting in availability impact.
Affected products
- Linux Linux kernel Multiple versions (Linux 2.6.11 through 7.2 and later affected; patch backported across all stable branches)
Timeline
- 2026-09-17: disclosed: CVE-2026-90335 published
- 2026-07-31: patched: Upstream fix committed by Karl Mehltretter
- 2026-08-03: patched: Fix merged to stable tree
- 2026-09-14: patched: Backport to stable releases by Greg Kroah-Hartman