In the Linux kernel, the following vulnerability has been resolved:

tty: port: fix tty port tty vhangup() race

Drivers rely on tty port tty vhangup() to synchronously hang up their ports before tearing down resources as part of deregistration (e.g. on physical disconnect).

If tty port tty vhangup() races with another hangup it may however return before the port has been shut down. This is in turn can lead to use-after-free and NULL-pointer dereferences in racing ioctls (including a synchronous hangup) and in processing of racing asynchronous hangups (carrier loss).

Add the missing serialisation to tty port tty vhangup() and tty port hangup() so that the former does not return until the port has been shut down also when there is a racing hangup.

Note that serial core does not use tty port hangup(), but it already holds the port mutex when clearing port->tty and shutting down the port in uart hangup().