Kernel Vulnerability in Linux Package: Console Registration and Memory Allocation Issue
Summary
DEBIAN-CVE-2026-90337: In the Linux kernel, the following vulnerability has been resolved: serial: core: do fallible allocations before the console can be registered serial_core_add_one_port() allocates uport->tty_groups after uart_configure_p... Affects linux versions 6.1.106-1 – 7.2~rc7-1~exp1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It is a critical part of many distributions, including Debian. This vulnerability affects the serial core of the Linux kernel, specifically during the allocation of tty groups and console registration, which can lead to system instability and security risks.
Vulnerability Detail
In the Linux kernel, a vulnerability exists in the serial_core_add_one_port() function, where the allocation of uport->tty_groups occurs after uart_configure_port(). This sequence can lead to the console being registered before the allocation is successful. If the allocation fails, the driver unwinds the port while the console remains registered, potentially causing a NULL dereference in PL011 console output and a KASAN use-after-free in i.MX console output after failed binds. This vulnerability can lead to system crashes and unpredictable behavior.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to apply the patch as soon as it is available to mitigate any risks associated with this issue.
Conclusion
The vulnerability in the Linux kernel's serial core poses significant risks to system stability and security. It is essential for users to stay informed about updates and apply patches promptly to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves improper memory allocation in the Linux kernel's serial core, which can lead to system instability.
You can use Vulert's playground to check if your application is affected by this vulnerability without any signup required.
Exploitation of this vulnerability can lead to system crashes, unpredictable behavior, and potential security risks.
Yes, a patch is expected to be released in the latest versions of the Linux package. Updating your system will apply the necessary fixes.
While there are no specific workarounds, it is crucial to monitor the situation and apply the patch as soon as it becomes available.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
