tty Cdev UAF

Vulnerability analysis

When the tty core registers a character device for a tty driver and the registration call fails, the error-handling path frees the character device object but leaves a stale pointer stored in the driver's device array. Later, when that tty device is unregistered, the stale pointer is passed to the character device deletion routine, resulting in a use-after-free on already-freed kernel memory. The fix clears the array slot immediately after freeing the object, so the subsequent unregistration path sees a null pointer and skips the invalid deletion. The vulnerable path is reachable locally whenever a tty driver attempts device registration and the character device addition fails—a condition that can arise under memory pressure or resource exhaustion—and the device is then torn down, which commonly happens during device hotplug removal or driver unload.