Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-89740

serial: imx: serialize imx_uart_ports[] lifetime

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 6.6.160, 6.12.109, 6.18.50, 7.2.4
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: serial: imx: serialize imx_uart_ports[] lifetime imx_uart_probe() publishes its devm-allocated port in imx_uart_ports[] before uart_add_one_port() because console setup uses the table. The entry is not cleared when adding the port fails or after removal, leaving a dangling pointer. A sibling probe can register the shared console through that stale entry. This was reproduced under KASAN on QEMU mcimx6ul-evk by unbinding a sibling UART, unbinding the console UART and rebinding the sibling. Keep the entry valid through uart_remove_one_port(), then clear it. Protect port addition and removal together with their table updates so sibling operations cannot interleave. Reject an occupied slot rather than clobbering an active port during a duplicate-line probe.

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • Linux Linux

    Version range not reported

  • Linux Linux

    2.6.27

  • KernelLinux

    From 2.6.27 · fixed in 6.6.160; From 6.7.0 · fixed in 6.12.109; From 6.13.0 · fixed in 6.18.50; From 6.19.0 · fixed in 7.2.4

References 7

git.kernel.org