HIGH Introduced in 4.3
tty Cdev UAF
CVE-2026-90334
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: tty: clear cdev pointer after cdev_add() failure tty_cdev_add() drops the cdev reference when cdev_add() fails, but leaves driver->cdevs[index] pointing to freed memory. tty_unregister_device() later passes that stale pointer to cdev_del(), causing a use-after-free. Clear the slot after dropping the reference.
02KernelScan AI Analysis
Risk summary
A use-after-free in the core tty subsystem occurs when character device registration fails, leaving a dangling pointer that is later dereferenced during device teardown. Local users who can trigger tty device registration failure (e.g., through memory pressure or device hotplug) can exploit this to corrupt kernel memory, potentially achieving privilege escalation or causing a system crash. Systems with exposed USB or serial ports are at higher risk due to hotplug-triggered registration paths.
Vulnerability analysis
When the tty core registers a character device for a tty driver and the registration call fails, the error-handling path frees the character device object but leaves a stale pointer stored in the driver's device array. Later, when that tty device is unregistered, the stale pointer is passed to the character device deletion routine, resulting in a use-after-free on already-freed kernel memory. The fix clears the array slot immediately after freeing the object, so the subsequent unregistration path sees a null pointer and skips the invalid deletion. The vulnerable path is reachable locally whenever a tty driver attempts device registration and the character device addition fails—a condition that can arise under memory pressure or resource exhaustion—and the device is then torn down, which commonly happens during device hotplug removal or driver unload.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 4.3 | 5.10.270 | fb1de260033c |
| 6.1 | 4.3 | 6.1.188 | 33a44333a9df |
| 6.18 | 4.3 | 6.18.52 | 4f6bd79bb7e5 |
| 6.6 | 4.3 | 6.6.157 | d331c63570af |
| 5.15 | 4.3 | 5.15.221 | e9e64dd02fd6 |
| 7.2 | 4.3 | 7.2.6 | 5c5a795bf624 |
| mainline | 4.3 | 7.3-rc1 | 6645856f0df3 |
| 6.12 | 4.3 | 6.12.110 | a83fcddf3c75 |
| cip/6.12 | 4.3 | 6.12.111-cip32 | a83fcddf3c75 |