HIGH Introduced in 3.17
serial PortAlloc UAF
CVE-2026-90337
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: serial: core: do fallible allocations before the console can be registered serial_core_add_one_port() allocates uport->tty_groups after uart_configure_port(), which may register the console. If the allocation fails, the driver unwinds the port while its console remains registered. The earlier uport->name allocation has a related failure path that leaves state->uart_port linked to a port being freed. Failslab reproduced a NULL dereference in PL011 console output and a KASAN use-after-free in i.MX console output after failed binds. Allocate the name and tty_groups before linking the port and configuring it. Reserve space for the optional driver attribute group because config_port() may populate uport->attr_group during configuration.
02KernelScan AI Analysis
Risk summary
A use-after-free in the serial core occurs when memory allocations fail during port registration, leaving a console registered to a freed port. Local users who can induce memory pressure may trigger kernel panics or memory corruption on systems with serial hardware. The bug affects most Linux systems since kernel 3.17 and is particularly dangerous on multi-tenant or container hosts where unprivileged users can influence memory availability.
Vulnerability analysis
During serial port registration, two fallible memory allocations—for the port name and for tty attribute groups—are performed after the port has already been linked into the driver state table and after the console may have been registered. If either allocation fails under memory pressure, the error path frees the port while the console still holds a reference to it and the driver state still points to the freed object, resulting in a use-after-free or NULL pointer dereference when console output is next attempted. The fix moves both allocations ahead of the port linking and configuration steps, so that an allocation failure simply returns an error before any console registration or state linkage occurs, making the failure path clean. The vulnerable path is reached locally during serial port registration, which happens at boot, during driver probe, or on device hotplug; an unprivileged local user can create the memory pressure needed to trigger the allocation failure, though precise timing is required.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| mainline | 3.17 | 7.3-rc1 | 1a0e4fbce5d9 |
| 7.2 | 3.17 | 7.2.6 | c2aec15f78b2 |