CVE-2026-23115

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> serial: Fix not set tty-&gt;port race condition<br /> <br /> Revert commit bfc467db60b7 ("serial: remove redundant<br /> tty_port_link_device()") because the tty_port_link_device() is not<br /> redundant: the tty-&gt;port has to be confured before we call<br /> uart_configure_port(), otherwise user-space can open console without TTY<br /> linked to the driver.<br /> <br /> This tty_port_link_device() was added explicitly to avoid this exact<br /> issue in commit fb2b90014d78 ("tty: link tty and port before configuring<br /> it as console"), so offending commit basically reverted the fix saying<br /> it is redundant without addressing the actual race condition presented<br /> there.<br /> <br /> Reproducible always as tty-&gt;port warning on Qualcomm SoC with most of<br /> devices disabled, so with very fast boot, and one serial device being<br /> the console:<br /> <br /> printk: legacy console [ttyMSM0] enabled<br /> printk: legacy console [ttyMSM0] enabled<br /> printk: legacy bootconsole [qcom_geni0] disabled<br /> printk: legacy bootconsole [qcom_geni0] disabled<br /> ------------[ cut here ]------------<br /> tty_init_dev: ttyMSM driver does not set tty-&gt;port. This would crash the kernel. Fix the driver!<br /> WARNING: drivers/tty/tty_io.c:1414 at tty_init_dev.part.0+0x228/0x25c, CPU#2: systemd/1<br /> Modules linked in: socinfo tcsrcc_eliza gcc_eliza sm3_ce fuse ipv6<br /> CPU: 2 UID: 0 PID: 1 Comm: systemd Tainted: G S 6.19.0-rc4-next-20260108-00024-g2202f4d30aa8 #73 PREEMPT<br /> Tainted: [S]=CPU_OUT_OF_SPEC<br /> Hardware name: Qualcomm Technologies, Inc. Eliza (DT)<br /> ...<br /> tty_init_dev.part.0 (drivers/tty/tty_io.c:1414 (discriminator 11)) (P)<br /> tty_open (arch/arm64/include/asm/atomic_ll_sc.h:95 (discriminator 3) drivers/tty/tty_io.c:2073 (discriminator 3) drivers/tty/tty_io.c:2120 (discriminator 3))<br /> chrdev_open (fs/char_dev.c:411)<br /> do_dentry_open (fs/open.c:962)<br /> vfs_open (fs/open.c:1094)<br /> do_open (fs/namei.c:4634)<br /> path_openat (fs/namei.c:4793)<br /> do_filp_open (fs/namei.c:4820)<br /> do_sys_openat2 (fs/open.c:1391 (discriminator 3))<br /> ...<br /> Starting Network Name Resolution...<br /> <br /> Apparently the flow with this small Yocto-based ramdisk user-space is:<br /> <br /> driver (qcom_geni_serial.c): user-space:<br /> ============================ ===========<br /> qcom_geni_serial_probe()<br /> uart_add_one_port()<br /> serial_core_register_port()<br /> serial_core_add_one_port()<br /> uart_configure_port()<br /> register_console()<br /> |<br /> | open console<br /> | ...<br /> | tty_init_dev()<br /> | driver-&gt;ports[idx] is NULL<br /> |<br /> tty_port_register_device_attr_serdev()<br /> tty_port_link_device() ports[idx]