critical CVSS 9.8

CVE-2026-53384·Kernel vulnerability

In the Linux kernel, the following vulnerability has been resolved: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails dw8250_probe() registers the 8250 port via serial8250_register_8250_port() and then, if the device has a clock, registers a clock notifier. If clk_notifier_register() fails, probe returns the error but leaves the 8250 port registered. The matching serial8250_unregister_port() lives in dw8250_remove(), which is not called when probe fails, so the port slot stays occupied until the device is rebound or the system is rebooted. The devm-allocated driver data is freed while the port still references it (via the saved private_data and serial_in/serial_out callbacks), so any access to that port slot before a rebind is a use-after-free hazard. Unregister the port on the clk_notifier_register() error path.

Severity
critical
Software
Kernel
Fixed in
7.1.2
Published

Affected versions

From: 7.1

Until: 7.1.2

Fixed in: 7.1.2

How to fix this CVE

Update your Linux kernel to version 7.1.2 or later to resolve a critical resource cleanup issue in the 8250 UART driver. When the clock notifier registration fails during probe, the serial port remains registered but becomes orphaned, creating a use-after-free condition. Apply this patch to prevent potential system instability and memory corruption through port access after device rebind.

sudo dnf update kernel kernel-devel

Defensia detects this vulnerability

How to check if you are affected

  1. Check installed kernel version with: uname -r (compare against 7.1.2 or later)
  2. Verify the dw8250 driver is loaded: lsmod | grep 8250_dw
  3. Check kernel configuration for SERIAL_8250_DW support: grep CONFIG_SERIAL_8250_DW /boot/config-$(uname -r)
  4. Confirm the patch is applied by checking: git log --oneline --all | grep 'unregister 8250 port if clk_notifier_register' in kernel source tree, or verify kernel version matches 7.1.2+

FAQ

What is CVE-2026-53384?

This vulnerability occurs in the 8250 UART driver when clock notifier registration fails during device initialization, leaving the serial port registered but referencing freed memory. It creates a use-after-free condition that can lead to system crashes or memory corruption when the orphaned port is accessed.

Is CVE-2026-53384 being actively exploited?

No, this CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and no public exploits are available. However, the critical CVSS score (9.8) indicates severe potential impact requiring immediate patching.

What versions of Kernel are affected by CVE-2026-53384?

Linux kernel versions 7.1 through 7.1.1 are affected. The fix is available in kernel 7.1.2 and all subsequent releases.

How do I check if my server is vulnerable to CVE-2026-53384?

Run 'uname -r' and check if the kernel version is between 7.1.0 and 7.1.1. If your version is 7.1.2 or higher, you are patched. Additionally verify if 8250_dw driver is in use with 'lsmod | grep 8250_dw'.

Does Defensia detect CVE-2026-53384?

Yes — Defensia's CVE advisory scanner compares installed kernel package versions against the NVD database. If a vulnerable kernel version is detected on a monitored server, CVE-2026-53384 will appear in your dashboard with remediation steps.

Related Kernel CVEs

CVE-2026-63795CVSS 10In the Linux kernel, the following vulnerability has been resolved: 9p: avoid putting oldfid in p9_client_walk() error path When p9_client_walk() is called with clone set to false, fid aliases oldfid. If the walk subsequently fails after the request has been sent, the error path jumps to clunk_fid, which currently calls p9_fid_put(fid) unconditionally. This drops a reference to oldfid even though ownership of oldfid remains with the caller. If this is the last reference, oldfid can be clunked and destroyed while the caller still expects it to be valid. A later use or put of oldfid can then trigger a use-after-free or refcount underflow. Fix this by only putting fid in the clunk_fid error path when it does not alias oldfid, matching the existing guard in the error path below. This can be triggered when a multi-component walk is split into multiple p9_client_walk() calls and a later non-cloning walk fails. A reproducer and refcount warning logs are available on request.
CVE-2026-64160CVSS 9.8In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential for tearing in ->remote_i_size and ->zero_point Fix potential tearing in using ->remote_i_size and ->zero_point by copying i_size_read() and i_size_write() and using the same seqcount as for i_size. We need to make sure that netfslib and the filesystems that use it always hold i_lock whilst updating any of the sizes to prevent i_size_seqcount from getting corrupted.
CVE-2026-53246CVSS 9.8In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used.
CVE-2026-52931CVSS 9.8In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: avoid use of uninit sender vars batadv_tp_recv_ack() and batadv_tp_stop() are only valid for tp_vars in the BATADV_TP_SENDER role. When called with a BATADV_TP_RECEIVER role, it proceeds to read sender-only members that were never initialized, leading to undefined behavior. This can be triggered when a node that is currently acting as a receiver in an ongoing tp_meter session receives a malicious ACK packet. Guard against this by checking tp_vars->role immediately after the lookup and bailing out if it is not BATADV_TP_SENDER, before any of those members are accessed.
CVE-2026-52955CVSS 9.8In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in crush_decode() A message of type CEPH_MSG_OSD_MAP containing a crush map with at least one bucket has two fields holding the bucket algorithm. If the values in these two fields differ, an out-of-bounds access can occur. This is the case because the first algorithm field (alg) is used to allocate the correct amount of memory for a bucket of this type, while the second algorithm field inside the bucket (b->alg) is used in the subsequent processing. This patch fixes the issue by adding a check that compares alg and b->alg and aborts the processing in case they differ. Furthermore, b->alg is set to 0 in this case, because the destruction of the crush map also uses this field to determine the bucket type, which can again result in an out-of-bounds access when trying to free the memory pointed to by the fields of the bucket. To correctly free the memory allocated for the bucket in such a case, the corresponding call to kfree is moved from the algorithm-specific crush_destroy_bucket functions to the generic crush_destroy_bucket().

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-53384. Free for 1 server.

Get started free