CVE-2026-89740

A flaw was found in the Linux kernel's serial: imx component. The imx_uart_probe() function publishes a device-managed allocated port in the imx_uart_ports[] array before it is fully added. If the port addition fails or the port is removed, the entry in the array is not properly cleared, resulting in a dangling pointer. This stale entry can then be used by a sibling probe to register a shared console, potentially leading to memory corruption and system instability or a denial of service.

A moderate-severity flaw was found in the Linux kernel's NXP i.MX serial (UART) driver as shipped in Red Hat Enterprise Linux 9 and 10 and in OpenShift Container Platform releases based on RHEL CoreOS 9. The imx_uart_probe() function publishes a device-managed allocated port in the imx_uart_ports[] array before uart_add_one_port() completes, and the entry is not cleared when port addition fails or when the port is removed, leaving a dangling pointer. A local attacker with the privileges needed to unbind and rebind UART devices on an affected system could use this stale entry so that a sibling probe registers the shared console, resulting in memory corruption that can crash the kernel and cause a denial of service. Red Hat rates this flaw Moderate severity with a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local privileged access to manipulate the serial devices and the impact is limited to system availability.

Red Hat Enterprise Linux 6, 7, and 8, and OpenShift Container Platform 4.12 (which ships RHEL CoreOS 8), are not affected because the vulnerable code is not present in those releases. For the affected Red Hat Enterprise Linux 9 and 10 and OpenShift Container Platform streams, the fix is currently deferred because the flaw is Moderate severity with a CVSS score below 7.0 and Red Hat does not file errata trackers for Moderate-severity flaws of this kind. The residual risk is that a local attacker who already has privileged access to rebind the i.MX UART devices could trigger the stale-pointer dereference and crash the system, causing a local denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.