CVE-2026-90336

A flaw was found in the Linux kernel's serial core component. When uart_register_driver() fails, pointers to freed memory are not properly cleared. This can allow a local attacker to cause a use-after-free condition by repeatedly attempting to register and bind a serial port. Successful exploitation of this vulnerability could lead to a system crash, resulting in a denial of service (DoS).

A failed uart_register_driver call can leave drv state or drv tty_driver pointing to released memory. A later device probe may treat the non NULL state pointer as evidence that registration already succeeded and can pass the freed state to uart_add_one_port. This creates a use-after-free condition with kernel crash and memory corruption risk. For the CVSS the PR:H is selected because reliable triggering normally requires fault injection or administrative control over serial device unbinding and rebinding. Attack complexity is high because registration must first fail and the affected device must then be probed again while the stale pointer remains. The issue is local and is not network reachable. Impact is at least a local denial of service via kernel crash and in the worst case may include confidentiality and integrity impact or privilege escalation due to reuse of the freed kernel memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.