Look up another CVE · open CVE-2026-53384 in the interactive tracker
CVE-2026-53384
serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
Published 2026-07-19 (3 months ago) by the Linux kernel CNA. Subsystem drivers/tty. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-53384 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixed | 6.1.177-1 | Update the kernel and reboot. Fixed in 6.1.177-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.95-1 | Update the kernel and reboot. Fixed in 6.12.95-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.0.14-1 | Update the kernel and reboot. Fixed in 7.0.14-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.0.14-1 | Update the kernel and reboot. Fixed in 7.0.14-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
dw8250_probe() registers the 8250 port via serial8250_register_8250_port() and then, if the device has a clock, registers a clock notifier. If clk_notifier_register() fails, probe returns the error but leaves the 8250 port registered. The matching serial8250_unregister_port() lives in dw8250_remove(), which is not called when probe fails, so the port slot stays occupied until the device is rebound or the system is rebooted. The devm-allocated driver data is freed while the port still references it (via the saved private_data and serial_in/serial_out callbacks), so any access to that port slot before a rebind is a use-after-free hazard. Unregister the port on the clk_notifier_register() error path.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/tty/serial/8250/8250_dw.c
- What this is
- SYNOPSYS DESIGNWARE 8250 UART DRIVERMAINTAINERS section matched on drivers/tty/serial/8250/8250_dw.c · Supported
Check it on the machine
grep -wE 'CONFIG_SERIAL_8250|CONFIG_SERIAL_8250_DW' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookwormYnot built on ppc64el/powerpc64le
- trixieYnot built on armel/rpi, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, s390x/s390x
- forky, sidYnot built on loong64/loong64, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, s390x/s390x
- Y
- built in where it is built at all; some flavours do not build it
- Build switches
- CONFIG_SERIAL_8250, CONFIG_SERIAL_8250_DW
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-07-19 (3 months ago)source
- CVSS
- 9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.52%, higher than 42.6% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/tty
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.19 | 6.1.177 | ccdf4510a387 |
| 5.19 | 6.6.144 | 511d2b92f8d2 |
| 5.19 | 6.12.95 | 07ffe414a708 |
| 5.19 | 6.18.38 | 3d205fe80f21 |
| 5.19 | 7.0.14 | d72650a4f334 |
| 5.19 | 7.1.2 | 778b9dda4b24 |
| 5.19 | 7.2 | 10fc708b4de7 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4700-1 | 2026-07-26 | bullseye 6.1.177-1~deb11u1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- The UAF is reached when the registered 8250 port is exercised via tty/console/IRQ callbacks in dw8250_serial_in/out; on dw8250-equipped embedded/industrial systems (RZN1, StarFive, Intel PCH UARTs) serial ports are commonly bridged to TCP (ser2net, Modbus/SCADA gateways, BMC SOL), letting a remote attacker drive those kernel paths without physical UART access.
- AC:LAttack complexity, low
- Once clk_notifier_register() fails during probe and devm frees dw8250_data while the port stays registered, any subsequent tty open, console write, or IRQ-driven handler reliably dereferences the dangling private_data and membase; no attacker-uncontrollable race or heap layout is required.
- PR:NPrivileges required, none
- The corrupt state can arise automatically at boot when probe fails under memory pressure (no attacker action), and on typical embedded deployments the affected /dev/ttyS* is reachable via unauthenticated network serial bridges or world-accessible console nodes without Linux account privileges.
- UI:NUser interaction, none
- Exploitation requires no victim interaction beyond the attacker (or boot-time probe failure) accessing the already-registered port; no mount, plug-in, or UI action is needed.
- S:UScope, unchanged
- Impact is confined to kernel memory via the serial driver UAF; it does not cross VM, container, or IOMMU security boundaries into a separate authority.
- C:HConfidentiality impact, high
- The bug leaves uart_port callbacks pointing at freed devm_kzalloc(dw8250_data) and freed devm_ioremap(membase), giving a kernel heap/IO-memory UAF that can be leveraged for arbitrary kernel memory disclosure.
- I:HIntegrity impact, high
- The same dangling private_data and membase pointers in serial_in/serial_out/IRQ handlers enable kernel heap corruption and control-flow hijack primitives typical of exploitable UAFs.
- A:HAvailability impact, high
- Any access to the orphaned port slot (tty I/O, serial console output, or IRQ handling) dereferences freed driver data and can cause kernel oops/panic, especially if the port serves as boot console.