CVE-2026-89740 in Linux
Summary
by MITRE • 09/11/2026
In the Linux kernel, the following vulnerability has been resolved:
serial: imx: serialize imx_uart_ports[] lifetime
imx_uart_probe() publishes its devm-allocated port in imx_uart_ports[]
before uart_add_one_port() because console setup uses the table. The entry is not cleared when adding the port fails or after removal, leaving a dangling pointer.
A sibling probe can register the shared console through that stale entry. This was reproduced under KASAN on QEMU mcimx6ul-evk by unbinding a sibling UART, unbinding the console UART and rebinding the sibling.
Keep the entry valid through uart_remove_one_port(), then clear it. Protect port addition and removal together with their table updates so sibling operations cannot interleave. Reject an occupied slot rather than clobbering an active port during a duplicate-line probe.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/11/2026
The vulnerability identified in the Linux kernel's serial imx driver involves a critical race condition related to the lifecycle management of UART ports and their associated console configurations. Specifically, the issue resides within the imx_uart_probe function, which is responsible for initializing Universal Asynchronous Receiver-Transmitter controllers on i.MX platforms. During this initialization process, the driver publishes its device-managed allocated port into a global array named imx_uart_ports before fully completing the registration via uart_add_one_port. This premature publication creates a window of vulnerability where the entry in the array is valid but potentially incomplete or unstable from the perspective of other kernel subsystems that rely on this table for console setup and management.
The core technical flaw stems from improper synchronization between port addition, removal, and global state updates. When uart_add_one_port fails due to configuration errors or resource conflicts, or when a port is subsequently removed via uart_remove_one_port, the corresponding entry in imx_uart_ports remains populated with stale pointers. This results in dangling references that point to memory regions that may have been freed or repurposed by other parts of the system. The lack of atomicity between updating the global array and managing the actual port lifecycle allows for interleaving operations where sibling probes can access these invalid entries, leading to undefined behavior such as kernel panics, data corruption, or potential privilege escalation if an attacker can exploit the memory state resulting from accessing freed resources.
The operational impact of this vulnerability is significant, particularly in systems utilizing multiple UART interfaces with shared console capabilities. As demonstrated through reproduction using Kernel Address Sanitizer on QEMU emulated mcimx6ul-evk hardware, unbinding a sibling UART followed by unbinding and rebinding the console UART triggers the race condition. A sibling probe can register the shared console through the stale entry left behind by the previous or failed operation. This scenario highlights how concurrent access to driver resources without proper locking mechanisms can lead to severe stability issues in multi-port serial environments, affecting system reliability during dynamic device configuration changes such as hot-plugging or module unloading and reloading.
To mitigate this vulnerability, the fix implements strict serialization of imx_uart_ports lifetime operations. The entry is now kept valid throughout the entire duration of uart_remove_one_port execution and is explicitly cleared only after removal is complete, ensuring no dangling pointers exist during active use. Furthermore, port addition and removal are protected with synchronization primitives to prevent sibling operations from interleaving with table updates. This ensures that concurrent probes cannot access inconsistent states. Additionally, the driver now rejects attempts to occupy an already occupied slot rather than clobbering an active port during duplicate-line probing, thereby preventing accidental overwrites of valid configurations.
From a security taxonomy perspective, this vulnerability aligns with CWE-416 Use After Free, as it involves accessing memory through pointers that have become invalid due to premature release or lack of proper lifecycle management. It also relates to CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization, highlighting the failure to properly serialize access to shared data structures like imx_uart_ports. In terms of MITRE ATT&CK mapping, this flaw could potentially be leveraged in techniques associated with T1059 Command and Scripting Interpreter if an attacker can trigger specific console operations through the dangling pointer, or more broadly under privilege escalation vectors where kernel memory corruption leads to control flow hijacking. The resolution emphasizes the importance of atomic state transitions and rigorous locking strategies in kernel drivers that manage shared hardware resources across multiple instances.