CVE-2024-26998

What it actually does

Race condition in serial core allows PM/timer callbacks to dereference a NULL circular buffer pointer after uart_tty_port_shutdown clears it under spinlock but before head/tail positions are synchronized, resulting in NULL pointer dereference during tx_chars or start_tx paths.

Why it matters to the business

Unexpected kernel crashes on Linux systems with serial ports during suspend or runtime power management, leading to service disruption and potential loss of availability on affected devices.

How an attack unfolds

An attacker or automated workload triggers serial port shutdown while simultaneously initiating a power management suspend sequence; the race allows a pending tx_chars callback to execute after the buffer pointer is NULLified but before state is fully cleared, causing a kernel NULL dereference panic.

How to fix it

Update the Linux kernel to a version containing commit e8f897f4afef0031fe618a8e94127a0934896aba or later; rebuild and deploy the updated kernel image on all affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit e8f897f4afef0031fe618a8e94127a0934896aba via git log or kernel version string; attempt to reproduce the original NULL dereference scenario under controlled suspend/shutdown workloads to verify absence of the crash.

Typical attack path

1. Obtain ability to open and shut down a serial tty port on the target system
2. Trigger or wait for a runtime suspend or system suspend event via pm_runtime_work or equivalent
3. Race the shutdown path against the suspend callback to hit the window where buffer is NULL but tx path still executes
4. Cause kernel panic via NULL pointer dereference in serial8250_tx_chars or similar

How to detect it

Review kernel logs (dmesg, /var/log/kern.log, journalctl) for NULL pointer dereference panics mentioning serial8250_tx_chars, serial_port_runtime_suspend, or pm_runtime_work around the time of port shutdown or suspend events.

What your security team should do

• Prioritize kernel updates on systems exposing serial ports or using 8250-family drivers
• Monitor for kernel oops/panic logs containing serial8250_tx_chars or pm_runtime_work during suspend
• Apply the fix across all distributions and embedded devices shipping the vulnerable serial core code