CVE-2026-90334

What it actually does

Use-after-free in Linux kernel tty subsystem where tty_cdev_add() fails to clear driver->cdevs[index] after cdev_add() drops the reference, allowing tty_unregister_device() to pass a stale pointer to cdev_del().

Why it matters to the business

Kernel instability or potential code execution on systems handling serial or console devices, increasing crash risk and maintenance overhead for affected Linux deployments.

How an attack unfolds

An attacker with local access triggers a cdev_add() failure path during tty device registration, leaving a dangling pointer; subsequent device unregistration via tty_unregister_device() dereferences the freed memory during cdev_del().

How to fix it

Apply the upstream kernel patch that clears the cdevs slot after dropping the reference on cdev_add() failure; rebuild and deploy updated kernel images across affected systems.

How to confirm the fix worked

Inspect tty core source for the pointer-clearing change after cdev_add() failure; compile and run regression tests exercising tty registration failure paths followed by unregistration.

Typical attack path

1. Obtain local access on target Linux system
2. Trigger tty device registration that causes cdev_add() to fail
3. Invoke tty_unregister_device() to dereference stale cdev pointer
4. Exploit resulting use-after-free for memory corruption or denial of service

How to detect it

Review kernel logs for oops or panic messages involving cdev_del or tty_unregister_device; examine crash dumps for use-after-free patterns in tty driver structures.

• tty_unregister_device
• tty_cdev_add
• driver->cdevs

What your security team should do

• Prioritize kernel updates containing the tty cdev fix in next maintenance window
• Monitor kernel mailing lists and distribution advisories for backported patches
• Limit exposure by restricting unprivileged access to tty device creation where feasible