Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-90334

tty: clear cdev pointer after cdev_add() failure

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: tty: clear cdev pointer after cdev_add() failure tty_cdev_add() drops the cdev reference when cdev_add() fails, but leaves driver->cdevs[index] pointing to freed memory. tty_unregister_device() later passes that stale pointer to cdev_del(), causing a use-after-free. Clear the slot after dropping the reference.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • c1a752ba2d6b8a52879c7ab637cff38359ea9827 to < fb1de260033c215dba438973d82b48562bdc86bbaffected
  • c1a752ba2d6b8a52879c7ab637cff38359ea9827 to < e9e64dd02fd68776afda00777591eca0c3984285affected
  • c1a752ba2d6b8a52879c7ab637cff38359ea9827 to < 33a44333a9dfda044b0e233399b12ead7f8a90aeaffected
  • c1a752ba2d6b8a52879c7ab637cff38359ea9827 to < d331c63570af61ef7aaf516b64a8d6f47518a3a4affected
  • c1a752ba2d6b8a52879c7ab637cff38359ea9827 to < a83fcddf3c75d004f12aa13555bb73da19fb75a9affected
  • c1a752ba2d6b8a52879c7ab637cff38359ea9827 to < 4f6bd79bb7e55095f09bec9b4eb6c09df1306116affected
  • c1a752ba2d6b8a52879c7ab637cff38359ea9827 to < 5c5a795bf6248fe96f96dd9fd79d66bbb4a92077affected
  • c1a752ba2d6b8a52879c7ab637cff38359ea9827 to < 6645856f0df3aeecd45519cb611415b4b89c2223affected

Linux Linux

Default version status: affected

  • 4.3affected
  • 0 to < 4.3unaffected
  • 5.10.270 to ≤ 5.10.*unaffected
  • 5.15.221 to ≤ 5.15.*unaffected
  • 6.1.188 to ≤ 6.1.*unaffected
  • 6.6.157 to ≤ 6.6.*unaffected
  • 6.12.110 to ≤ 6.12.*unaffected
  • 6.18.52 to ≤ 6.18.*unaffected
  • 7.2.6 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References