CVE-2026-90336 serial: core: clear freed pointers on uart_register_driver() failure
A use-after-free vulnerability in the Linux kernel serial core allows local attackers to potentially execute code or escalate privileges via failed driver registration.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90336?
CVE-2026-90336 is an use after free vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
serial: core: clear freed pointers on uart_register_driver() failure
uart_register_driver() leaves drv->state pointing to freed memory when tty_alloc_driver() fails. If tty_register_driver() fails, drv->tty_driver also retains a pointer after its reference is dropped.
Drivers that use drv->state as an "already registered" flag can then skip registration on the next probe and pass the freed state to uart_add_one_port().
This issue was found with failslab on QEMU's raspi1ap board by failing registration and binding the PL011 port again.
Clear both pointers on their failure paths, as uart_unregister_driver() already does.
Which versions are affected by CVE-2026-90336?
How do I fix CVE-2026-90336?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-90336 being exploited?
There is no known exploitation of CVE-2026-90336 in the wild and no public exploit code.
Sources
Also known as AZL-102156, BELL-CVE-2026-90336, DEBIAN-CVE-2026-90336, GHSA-wphw-rfmf-7hpg, UBUNTU-CVE-2026-90336.