CVE-2026-53384

Last refreshed2026-10-17

Status: UPDATED | Advisory ID: CVE-2026-53384

Key Details

CVE	CVE-2026-53384
CVSS Score / Version	9.8 (Critical) / CVSS v3.1
Updated	2026-10-16
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is network; attack complexity is low; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel
Classified as	CWE-416 (Use After Free)

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails

dw8250_probe() registers the 8250 port via serial8250_register_8250_port()

and then, if the device has a clock, registers a clock notifier. If

clk_notifier_register() fails, probe returns the error but leaves the

8250 port registered. The matching serial8250_unregister_port() lives

in dw8250_remove(), which is not called when probe fails, so the port

slot stays occupied until the device is rebound or the system is

rebooted. The devm-allocated driver data is freed while the port still

references it (via the saved private_data and serial_in/serial_out

callbacks), so any access to that port slot before a rebind is a

use-after-free hazard.

Unregister the port on the clk_notifier_register() error path. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-53384
CVE	https://www.cve.org/CVERecord?id=CVE-2026-53384

Source

Reference

NVD

CVE