CVE-2026-90336

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

serial: core: clear freed pointers on uart_register_driver() failure

uart_register_driver() leaves drv->state pointing to freed memory when

tty_alloc_driver() fails. If tty_register_driver() fails, drv->tty_driver

also retains a pointer after its reference is dropped.

Drivers that use drv->state as an "already registered" flag can then skip

registration on the next probe and pass the freed state to

uart_add_one_port().

This issue was found with failslab on QEMU's raspi1ap board by

failing registration and binding the PL011 port again.

Clear both pointers on their failure paths, as uart_unregister_driver()

already does.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References