In the Linux kernel, the following vulnerability has been resolved:
tty: serial: uartlite: register uart driver in init
When two instances of uart devices are probing, a concurrency race can occur. If one thread calls uartregisterdriver function, which first allocates and assigns memory to 'uartstate' member of uartdriver structure, the other instance can bypass uart driver registration and call uliteassign. This calls uartaddoneport, which expects the uart driver to be fully initialized. This leads to a kernel panic due to a null pointer dereference:
[ 8.143581] BUG: kernel NULL pointer dereference, address: 00000000000002b8 [ 8.156982] #PF: supervisor write access in kernel mode [ 8.156984] #PF: errorcode(0x0002) - not-present page [ 8.156986] PGD 0 P4D 0 ... [ 8.180668] RIP: 0010:mutexlock+0x19/0x30 [ 8.188624] Call Trace: [ 8.188629] ? _diebody.cold+0x1a/0x1f [ 8.195260] ? pagefaultoops+0x15c/0x290 [ 8.209183] ? _irqresolvemapping+0x47/0x80 [ 8.209187] ? excpagefault+0x64/0x140 [ 8.209190] ? asmexcpagefault+0x22/0x30 [ 8.209196] ? mutexlock+0x19/0x30 [ 8.223116] uartaddoneport+0x60/0x440 [ 8.223122] ? procttyregisterdriver+0x43/0x50 [ 8.223126] ? ttyregisterdriver+0x1ca/0x1e0 [ 8.246250] uliteprobe+0x357/0x4b0 [uartlite]
To prevent it, move uart driver registration in to init function. This will ensure that uart_driver is always registered when probe function is called.
[
{
"digest": {
"line_hashes": [
"264952985970039642136532488456723419015",
"20390689462465768179015406159760933671",
"188056662320727731132094500671426856976",
"121660567616920400602660036998032367724",
"76253456556846092907925626051863886274",
"31991388492554879220880081706975654513",
"214451849918493530588320390251805919331",
"232058019471892742095957425258090726737",
"125202706443727050779580343138981342578",
"96783941465209406786089061635375172874",
"294697614195988830534711634582200738022",
"210912234537376485982832260918849975762",
"33978973174275847840403798783722321562",
"327300570208651633521073833320682705253",
"120889001608639475301508481049952616535",
"280246557683833013346878899116569692597",
"291864821726445757431273784882133306184",
"315906418551813806396744483070189178160",
"283564345058804493761665138433758034093",
"90320661988413557258700904183091915621",
"200380481926178334448045172939849035638",
"313497015809954240279780448505493195343",
"50839374718800262705936164493630486093",
"270038963533175525759556702302403226451"
],
"threshold": 0.9
},
"target": {
"file": "drivers/tty/serial/uartlite.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5e4229d94792b40e750f30c92bcf7a3107c72ef",
"id": "CVE-2025-38262-0c59c776",
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"264952985970039642136532488456723419015",
"20390689462465768179015406159760933671",
"188056662320727731132094500671426856976",
"121660567616920400602660036998032367724",
"76253456556846092907925626051863886274",
"31991388492554879220880081706975654513",
"214451849918493530588320390251805919331",
"232058019471892742095957425258090726737",
"125202706443727050779580343138981342578",
"96783941465209406786089061635375172874",
"294697614195988830534711634582200738022",
"210912234537376485982832260918849975762",
"33978973174275847840403798783722321562",
"327300570208651633521073833320682705253",
"120889001608639475301508481049952616535",
"280246557683833013346878899116569692597",
"291864821726445757431273784882133306184",
"315906418551813806396744483070189178160",
"283564345058804493761665138433758034093",
"90320661988413557258700904183091915621",
"200380481926178334448045172939849035638",
"313497015809954240279780448505493195343",
"50839374718800262705936164493630486093",
"270038963533175525759556702302403226451"
],
"threshold": 0.9
},
"target": {
"file": "drivers/tty/serial/uartlite.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6bd697b5fc39fd24e2aa418c7b7d14469f550a93",
"id": "CVE-2025-38262-0d873ebd",
"signature_type": "Line"
},
{
"digest": {
"length": 142.0,
"function_hash": "287329581472722311696011546477898773718"
},
"target": {
"function": "ulite_exit",
"file": "drivers/tty/serial/uartlite.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5e4229d94792b40e750f30c92bcf7a3107c72ef",
"id": "CVE-2025-38262-15fadafb",
"signature_type": "Function"
},
{
"digest": {
"length": 145.0,
"function_hash": "239438724097275611598332106628191831668"
},
"target": {
"function": "ulite_init",
"file": "drivers/tty/serial/uartlite.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5015eed450005bab6e5cb6810f7a62eab0434fc4",
"id": "CVE-2025-38262-2800b6a7",
"signature_type": "Function"
},
{
"digest": {
"length": 2319.0,
"function_hash": "27381541210290950004315544359881738676"
},
"target": {
"function": "ulite_probe",
"file": "drivers/tty/serial/uartlite.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5e4229d94792b40e750f30c92bcf7a3107c72ef",
"id": "CVE-2025-38262-29387195",
"signature_type": "Function"
},
{
"digest": {
"length": 2319.0,
"function_hash": "27381541210290950004315544359881738676"
},
"target": {
"function": "ulite_probe",
"file": "drivers/tty/serial/uartlite.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6bd697b5fc39fd24e2aa418c7b7d14469f550a93",
"id": "CVE-2025-38262-346453f4",
"signature_type": "Function"
},
{
"digest": {
"length": 2319.0,
"function_hash": "27381541210290950004315544359881738676"
},
"target": {
"function": "ulite_probe",
"file": "drivers/tty/serial/uartlite.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8e958d10dd0ce5ae674cce460db5c9ca3f25243b",
"id": "CVE-2025-38262-3f3e95c9",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"264952985970039642136532488456723419015",
"20390689462465768179015406159760933671",
"188056662320727731132094500671426856976",
"121660567616920400602660036998032367724",
"76253456556846092907925626051863886274",
"31991388492554879220880081706975654513",
"214451849918493530588320390251805919331",
"232058019471892742095957425258090726737",
"125202706443727050779580343138981342578",
"96783941465209406786089061635375172874",
"294697614195988830534711634582200738022",
"210912234537376485982832260918849975762",
"33978973174275847840403798783722321562",
"327300570208651633521073833320682705253",
"120889001608639475301508481049952616535",
"280246557683833013346878899116569692597",
"291864821726445757431273784882133306184",
"315906418551813806396744483070189178160",
"283564345058804493761665138433758034093",
"90320661988413557258700904183091915621",
"200380481926178334448045172939849035638",
"313497015809954240279780448505493195343",
"50839374718800262705936164493630486093",
"270038963533175525759556702302403226451"
],
"threshold": 0.9
},
"target": {
"file": "drivers/tty/serial/uartlite.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8e958d10dd0ce5ae674cce460db5c9ca3f25243b",
"id": "CVE-2025-38262-42dd3bca",
"signature_type": "Line"
},
{
"digest": {
"length": 142.0,
"function_hash": "287329581472722311696011546477898773718"
},
"target": {
"function": "ulite_exit",
"file": "drivers/tty/serial/uartlite.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5015eed450005bab6e5cb6810f7a62eab0434fc4",
"id": "CVE-2025-38262-5d4b0244",
"signature_type": "Function"
},
{
"digest": {
"length": 145.0,
"function_hash": "239438724097275611598332106628191831668"
},
"target": {
"function": "ulite_init",
"file": "drivers/tty/serial/uartlite.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8e958d10dd0ce5ae674cce460db5c9ca3f25243b",
"id": "CVE-2025-38262-8a618444",
"signature_type": "Function"
},
{
"digest": {
"length": 142.0,
"function_hash": "287329581472722311696011546477898773718"
},
"target": {
"function": "ulite_exit",
"file": "drivers/tty/serial/uartlite.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6bd697b5fc39fd24e2aa418c7b7d14469f550a93",
"id": "CVE-2025-38262-90f8562d",
"signature_type": "Function"
},
{
"digest": {
"length": 145.0,
"function_hash": "239438724097275611598332106628191831668"
},
"target": {
"function": "ulite_init",
"file": "drivers/tty/serial/uartlite.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5e4229d94792b40e750f30c92bcf7a3107c72ef",
"id": "CVE-2025-38262-9b6d95e0",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"33978973174275847840403798783722321562",
"327300570208651633521073833320682705253",
"120889001608639475301508481049952616535",
"280246557683833013346878899116569692597",
"291864821726445757431273784882133306184",
"315906418551813806396744483070189178160",
"283564345058804493761665138433758034093",
"90320661988413557258700904183091915621",
"200380481926178334448045172939849035638",
"313497015809954240279780448505493195343",
"50839374718800262705936164493630486093",
"270038963533175525759556702302403226451"
],
"threshold": 0.9
},
"target": {
"file": "drivers/tty/serial/uartlite.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5015eed450005bab6e5cb6810f7a62eab0434fc4",
"id": "CVE-2025-38262-a301aa95",
"signature_type": "Line"
},
{
"digest": {
"length": 145.0,
"function_hash": "239438724097275611598332106628191831668"
},
"target": {
"function": "ulite_init",
"file": "drivers/tty/serial/uartlite.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6bd697b5fc39fd24e2aa418c7b7d14469f550a93",
"id": "CVE-2025-38262-a6427c60",
"signature_type": "Function"
},
{
"digest": {
"length": 142.0,
"function_hash": "287329581472722311696011546477898773718"
},
"target": {
"function": "ulite_exit",
"file": "drivers/tty/serial/uartlite.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8e958d10dd0ce5ae674cce460db5c9ca3f25243b",
"id": "CVE-2025-38262-dc874867",
"signature_type": "Function"
}
]