CVE-2026-90334

A flaw was found in the Linux kernel's tty subsystem. When a character device (cdev) is added and fails, a pointer to the device's memory is not properly cleared. This can lead to a 'use-after-free' vulnerability, where the system attempts to access memory that has already been released. A local attacker could potentially exploit this to cause a system crash (denial of service) or, in some scenarios, execute arbitrary code.

A use after free can occur in the tty device registration path when tty_cdev_add drops the cdev reference after cdev_add fails but leaves driver cdevs index pointing to freed memory. A later tty_unregister_device call can pass this stale pointer to cdev_del, which turns the failed registration path into a kernel memory safety issue. For the CVSS the PR:L is used in the paranoid score because a local user may be able to influence failure timing indirectly through memory pressure or delegated device management, although reliable triggering normally requires privileged driver or device lifecycle control. The issue is not network reachable and is triggered through local device registration and unregister paths. Impact is at least local denial of service via kernel crash and in the worst defensible case may include confidentiality and integrity impact or privilege escalation due to kernel UAF memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.