CVE-2026-53384: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-19 · updated 2026-10-19
Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails dw8250_probe() registers the 8250 port via serial8250_register_8250_port() and then, if the device has a clock, registers a clock notifier. If clk_notifier_register() fails, probe returns the error but leaves the 8250 port registered. The matching serial8250_unregister_port() lives in dw8250_remove(), which is not called when probe fails, so the port slot stays occupied until the device is rebound or the system is rebooted. The devm-allocated driver data is freed while the port still references it (via the saved private_data and serial_in/serial_out callbacks), so any access to that port slot before a rebind is a use-after-free hazard. Unregister the port on the clk_notifier_register() error path.

Affected products

Linux kernel: from 5.19 before 6.1.177; from 6.2 before 6.6.144; from 6.7 before 6.12.95; from 6.13 before 6.18.38; from 6.19 before 7.0.14; from 7.1 before 7.1.2 — fixed in 6.1.177, 6.12.95, 6.18.38, 6.6.144, 7.0.14, 7.1.2

How to fix

Upgrade to a fixed version: Linux kernel 6.1.177, 6.12.95, 6.18.38, 6.6.144. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-53384 or the next vulnerability affects your stack