CVE-2026-89740 serial: imx: serialize imx_uart_ports[] lifetime
A use-after-free in the Linux kernel i.MX serial driver allows local attackers to execute code or escalate privileges via race conditions during device binding.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89740?
CVE-2026-89740 is an use after free vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
serial: imx: serialize imx_uart_ports[] lifetime
imx_uart_probe() publishes its devm-allocated port in imx_uart_ports[] before uart_add_one_port() because console setup uses the table. The entry is not cleared when adding the port fails or after removal, leaving a dangling pointer.
A sibling probe can register the shared console through that stale entry. This was reproduced under KASAN on QEMU mcimx6ul-evk by unbinding a sibling UART, unbinding the console UART and rebinding the sibling.
Keep the entry valid through uart_remove_one_port(), then clear it. Protect port addition and removal together with their table updates so sibling operations cannot interleave. Reject an occupied slot rather than clobbering an active port during a duplicate-line probe.
Which versions are affected by CVE-2026-89740?
How do I fix CVE-2026-89740?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-89740 being exploited?
There is no known exploitation of CVE-2026-89740 in the wild and no public exploit code.
Sources
Also known as AZL-100154, BELL-CVE-2026-89740, DEBIAN-CVE-2026-89740, GHSA-q55c-3wjg-8jjp, UBUNTU-CVE-2026-89740.