Cloudanix VulnDB

CVE-2026-90337

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing problem in the Linux kernel's serial port setup can cause crashes when memory runs low during driver loading on devices that use serial consoles.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free and NULL dereference in Linux kernel serial_core_add_one_port() when tty_groups or name allocations fail after uart_configure_port() has registered a console, leaving state->uart_port linked to freed memory or causing console writes on invalid state.

Why it matters to the business

Unexpected kernel crashes or memory corruption on systems using serial consoles during driver load or bind failures, potentially causing downtime on embedded or server hardware relying on early console output.

How an attack unfolds

An attacker with local access triggers allocation failures (via memory pressure or failslab) during serial port registration so that console registration completes before the allocation, then forces a console write or port teardown that dereferences freed structures.

How to fix it

Apply the upstream fix that moves name and tty_groups allocations before port linking and uart_configure_port; rebuild and deploy updated kernel images to affected systems.

How to confirm the fix worked

Boot with the patched kernel, attempt serial driver bind under memory pressure, and confirm absence of KASAN reports or NULL dereferences in console paths; inspect serial_core.c for the reordered allocation sequence.

Typical attack path

  1. Trigger memory pressure or use failslab to force allocation failure in serial_core_add_one_port
  2. uart_configure_port registers the console before name or tty_groups allocation
  3. Failure path unlinks or frees the port while console remains registered
  4. Subsequent console output performs use-after-free write or NULL dereference

How to detect it

Search kernel logs and dmesg for PL011 or i.MX console NULL dereference or KASAN use-after-free reports during serial port registration or bind failures; correlate with allocation failure injection or low-memory conditions.

  • NULL dereference in PL011 console output
  • KASAN use-after-free in i.MX console output
  • serial_core_add_one_port allocation failure unwind

What your security team should do

  • Prioritize kernel updates on systems exposing serial consoles
  • Monitor kernel logs for serial-related oops or KASAN warnings
  • Test driver load/unload sequences under constrained memory before production rollout
  • Consider disabling unnecessary serial ports where feasible

The record

In the Linux kernel, the following vulnerability has been resolved: serial: core: do fallible allocations before the console can be registered serial_core_add_one_port() allocates uport->tty_groups after uart_configure_port(), which may register the console. If the allocation fails, the driver unwinds the port while its console remains registered. The earlier uport->name allocation has a related failure path that leaves state->uart_port linked to a port being freed. Failslab reproduced a NULL dereference in PL011 console output and a KASAN use-after-free in i.MX console output after failed binds. Allocate the name and tty_groups before linking the port and configuring it. Reserve space for the optional driver attribute group because config_port() may populate uport->attr_group during configuration.

Affected packages

Ecosystem Package Introduced Fixed