CVE-2026-97480

A flaw was found in the Linux kernel's 8250 serial driver. During serial port registration for devices lacking an associated parent device, the driver attempts to access device properties without verifying that the device pointer is valid. This condition leads to a NULL pointer dereference, which can be triggered to crash the system and cause a Denial of Service (DoS).

Red Hat Product Security rates the impact of this flaw as Low. A NULL pointer dereference flaw was found in the Linux kernel's 8250 serial driver. When serial8250_register_8250_port() registers a serial port that has no associated parent device (legacy non-OF/non-ACPI registration), uart->port.dev can remain NULL, and the immediately following has_acpi_companion() check dereferences that pointer unconditionally, causing a kernel oops or panic. A local attacker with privileged access (for example, the ability to load the serial driver or control device/platform registration) could trigger this path to crash the system, resulting in a denial of service; there is no impact on confidentiality or integrity. Red Hat Enterprise Linux 9 (including the kernel-rt variant), Red Hat Enterprise Linux 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases based on RHEL CoreOS 9 are affected. Because exploitation requires privileged local access and the consequence is limited to availability, the fix is currently deferred for the affected streams; the residual risk is that a privileged local user can panic the kernel on an affected system. Red Hat Enterprise Linux 6, 7, and 8, and OpenShift Container Platform 4.12 (RHEL CoreOS 8), are not affected because the vulnerable code is not present in those products. Although the Red Hat CVSS 3.1 base score is 5.5 (Moderate), Red Hat's overall impact rating is Low because the flaw is not remotely exploitable, requires privileged local access, and results only in denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.