Executive brief
The Linux kernel's serial driver registration function fails to clear pointers when initialization fails, leaving freed memory references in place. On subsequent probe attempts, drivers may reuse these stale pointers, leading to use-after-free memory access that could cause system crashes or unexpected behavior.
Technical details
A use-after-free vulnerability exists in uart_register_driver() in drivers/tty/serial/serial_core.c. When tty_alloc_driver() or tty_register_driver() fails, the function frees memory but fails to null out the drv->state and drv->tty_driver pointers. Drivers that check these pointers as "already registered" flags will incorrectly reuse freed memory on subsequent probe attempts, passing dangling pointers to uart_add_one_port(). The vulnerability requires driver probe to be triggered multiple times with intermediate failure injection (discovered via failslab testing). The fix adds explicit NULL assignments on the failure paths, mirroring the cleanup already performed by uart_unregister_driver().
Affected products
- Linux Linux kernel all versions (regression from 2.6.12-rc2)
Timeline
- 2026-09-17: disclosed: Published in NVD
- 2026-08-03: patched: Upstream commit 61a2fb25551be0375bc16ef2a70c987dfca26183
- 2026-07-31: other: Patch authored by Karl Mehltretter