Serial Port Management Vulnerability in Linux Kernel Affecting IMX UART Ports

CVE-2026-89740

What is CVE-2026-89740?

A vulnerability exists in the Linux kernel concerning the management of IMX UART ports, where the imx_uart_probe() function inadvertently publishes a devm-allocated port into the imx_uart_ports[] before the completion of uart_add_one_port(). This premature publication can result in a dangling pointer, as the port entry is not cleared upon a failed addition or after removal. Consequently, a sibling probe may mistakenly register through a stale entry, leading to undefined behavior. Mitigations involve ensuring the validity of the entry during uart_remove_one_port() and appropriately managing port additions and removals to prevent sibling operations from interfering, which could result in overwriting active ports on duplicate probes.

References