CVE-2026-98747

What it actually does

NULL pointer dereference in serial_core_unregister_port when port->port_dev is NULL due to registration failure or teardown, leading to kernel crash via KASAN null-ptr-deref.

Why it matters to the business

Potential denial-of-service through system instability or crashes on Linux systems handling serial ports, though low exploitability and recent publication limit immediate operational risk.

How an attack unfolds

An attacker with local access triggers a serial port registration failure path followed by unregistration (e.g., via unbind_store or device removal) to dereference a cleared port_dev pointer under serial8250 handling.

How to fix it

Apply the upstream kernel patch that adds an early return for NULL port_dev, clears port_dev on register error paths, and reads under port_mutex; rebuild and deploy updated kernel images.

How to confirm the fix worked

Verify kernel source contains the early-return and mutex-protected checks in serial_core_unregister_port; test with serial8250 registration failure scenarios and confirm absence of KASAN reports.

Typical attack path

1. Cause serial_core_register_port to fail before serial_core_port_device_add
2. Invoke serial_core_unregister_port via device unbind or driver removal
3. Trigger NULL dereference in serial_core_get_ctrl_dev under missing port_mutex protection

How to detect it

Inspect kernel logs and KASAN reports for mentions of serial_core_unregister_port, serial8250_unregister_port, serial8250_remove, or null-ptr-deref at low addresses; correlate with device unbind events.

• KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047]
• RIP: serial_core_unregister_port
• Call Trace: serial8250_unregister_port
• serial_core_get_ctrl_dev

What your security team should do

• Monitor for kernel updates addressing serial core NULL dereference
• Prioritize patching on systems exposing serial devices to untrusted users
• Review device driver unbind paths for similar port handling issues