CVE-2026-90337

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the serial core where serial core add one port() performs fallible allocations for uport->tty groups after uart configure port(), which may register the console. If this allocation fails, the driver unwinds the port while the console remains registered. Additionally, the uport->name allocation contains a failure path that leaves state->uart port linked to a port being freed. This can lead to a NULL dereference in PL011 console output and a KASAN use-after-free in i.MX console output after failed binds. KASAN (Kernel Address Sanitizer) is a dynamic memory error detector for the Linux kernel.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.