CVE-2026-90335

What it actually does

NULL-pointer dereference occurs when cdev_del() is invoked on an uninitialized (NULL) cdev slot during TTY port cleanup after early registration failure.

Why it matters to the business

Systems relying on serial TTY devices may experience unexpected kernel crashes or service interruptions during device attach or detach operations.

How an attack unfolds

An attacker triggers a TTY device registration path that fails before cdev allocation, then forces the subsequent removal path that unconditionally calls cdev_del() on the NULL slot, resulting in a kernel panic.

How to fix it

Apply the upstream kernel patch that adds a NULL check before calling cdev_del() on the TTY cdev slot; rebuild and deploy the fixed kernel image to all affected systems.

How to confirm the fix worked

Inspect the tty core source for the conditional guard around cdev_del(); verify the running kernel version contains the commit that resolves the early-registration failure path.

Typical attack path

1. Trigger TTY registration failure before cdev allocation (e.g., via malformed serial configuration or resource exhaustion)
2. Ensure the serial core retains the port for later setserial access
3. Invoke port removal or module unload that reaches the unconditional cdev_del(NULL) call
4. Kernel dereferences NULL pointer and panics

How to detect it

Search kernel logs and dmesg for oops or panic messages referencing cdev_del and tty registration failure; correlate with serial port attach events.

• cdev_del.*NULL
• tty_register_device.*failed.*cdev
• Unable to handle kernel NULL pointer dereference.*cdev_del

What your security team should do

• Prioritize kernel updates on systems exposing serial TTY interfaces
• Monitor kernel logs for NULL dereference oops in tty/serial paths
• Test serial device attach/detach sequences after patching to confirm stability