AZL-102414
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-102414.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-102414
- Upstream
- Published
- 2026-09-17T17:17:32Z
- Modified
- 2026-09-18T14:15:35Z
- Summary
- CVE-2026-90337 affecting package kernel 6.6.150.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
serial: core: do fallible allocations before the console can be registered
serial_core_add_one_port() allocates uport->tty_groups after uart_configure_port(), which may register the console. If the allocation fails, the driver unwinds the port while its console remains registered. The earlier uport->name allocation has a related failure path that leaves state->uart_port linked to a port being freed.
Failslab reproduced a NULL dereference in PL011 console output and a KASAN use-after-free in i.MX console output after failed binds.
Allocate the name and tty_groups before linking the port and configuring it. Reserve space for the optional driver attribute group because config_port() may populate uport->attr_group during configuration.
- References