In the Linux kernel, the following vulnerability has been resolved:
tty: serial: uartlite: register uart driver in init
When two instances of uart devices are probing, a concurrency race can occur. If one thread calls uartregisterdriver function, which first allocates and assigns memory to 'uartstate' member of uartdriver structure, the other instance can bypass uart driver registration and call uliteassign. This calls uartaddoneport, which expects the uart driver to be fully initialized. This leads to a kernel panic due to a null pointer dereference:
[ 8.143581] BUG: kernel NULL pointer dereference, address: 00000000000002b8 [ 8.156982] #PF: supervisor write access in kernel mode [ 8.156984] #PF: errorcode(0x0002) - not-present page [ 8.156986] PGD 0 P4D 0 ... [ 8.180668] RIP: 0010:mutexlock+0x19/0x30 [ 8.188624] Call Trace: [ 8.188629] ? _diebody.cold+0x1a/0x1f [ 8.195260] ? pagefaultoops+0x15c/0x290 [ 8.209183] ? _irqresolvemapping+0x47/0x80 [ 8.209187] ? excpagefault+0x64/0x140 [ 8.209190] ? asmexcpagefault+0x22/0x30 [ 8.209196] ? mutexlock+0x19/0x30 [ 8.223116] uartaddoneport+0x60/0x440 [ 8.223122] ? procttyregisterdriver+0x43/0x50 [ 8.223126] ? ttyregisterdriver+0x1ca/0x1e0 [ 8.246250] uliteprobe+0x357/0x4b0 [uartlite]
To prevent it, move uart driver registration in to init function. This will ensure that uart_driver is always registered when probe function is called.
[
{
"digest": {
"function_hash": "287329581472722311696011546477898773718",
"length": 142.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@685d29f2c5057b32c7b1b46f2a7d303b926c8f72",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-38262-006eec86",
"target": {
"file": "drivers/tty/serial/uartlite.c",
"function": "ulite_exit"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"264952985970039642136532488456723419015",
"20390689462465768179015406159760933671",
"188056662320727731132094500671426856976",
"121660567616920400602660036998032367724",
"76253456556846092907925626051863886274",
"31991388492554879220880081706975654513",
"214451849918493530588320390251805919331",
"232058019471892742095957425258090726737",
"125202706443727050779580343138981342578",
"96783941465209406786089061635375172874",
"294697614195988830534711634582200738022",
"210912234537376485982832260918849975762",
"33978973174275847840403798783722321562",
"327300570208651633521073833320682705253",
"120889001608639475301508481049952616535",
"280246557683833013346878899116569692597",
"291864821726445757431273784882133306184",
"315906418551813806396744483070189178160",
"283564345058804493761665138433758034093",
"90320661988413557258700904183091915621",
"200380481926178334448045172939849035638",
"313497015809954240279780448505493195343",
"50839374718800262705936164493630486093",
"270038963533175525759556702302403226451"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5e4229d94792b40e750f30c92bcf7a3107c72ef",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2025-38262-0c59c776",
"target": {
"file": "drivers/tty/serial/uartlite.c"
}
},
{
"digest": {
"function_hash": "287329581472722311696011546477898773718",
"length": 142.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5e4229d94792b40e750f30c92bcf7a3107c72ef",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-38262-15fadafb",
"target": {
"file": "drivers/tty/serial/uartlite.c",
"function": "ulite_exit"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"264952985970039642136532488456723419015",
"20390689462465768179015406159760933671",
"188056662320727731132094500671426856976",
"121660567616920400602660036998032367724",
"76253456556846092907925626051863886274",
"31991388492554879220880081706975654513",
"214451849918493530588320390251805919331",
"232058019471892742095957425258090726737",
"125202706443727050779580343138981342578",
"96783941465209406786089061635375172874",
"294697614195988830534711634582200738022",
"210912234537376485982832260918849975762",
"33978973174275847840403798783722321562",
"327300570208651633521073833320682705253",
"120889001608639475301508481049952616535",
"280246557683833013346878899116569692597",
"291864821726445757431273784882133306184",
"315906418551813806396744483070189178160",
"283564345058804493761665138433758034093",
"90320661988413557258700904183091915621",
"200380481926178334448045172939849035638",
"313497015809954240279780448505493195343",
"50839374718800262705936164493630486093",
"270038963533175525759556702302403226451"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@685d29f2c5057b32c7b1b46f2a7d303b926c8f72",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2025-38262-232259a1",
"target": {
"file": "drivers/tty/serial/uartlite.c"
}
},
{
"digest": {
"function_hash": "27381541210290950004315544359881738676",
"length": 2319.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5e4229d94792b40e750f30c92bcf7a3107c72ef",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-38262-29387195",
"target": {
"file": "drivers/tty/serial/uartlite.c",
"function": "ulite_probe"
}
},
{
"digest": {
"function_hash": "231553566517086797734023423939016967182",
"length": 1377.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9c905fdbba68a6d73d39a6b7de9b9f0d6c46df87",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-38262-34d3793b",
"target": {
"file": "drivers/tty/serial/uartlite.c",
"function": "ulite_probe"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"264952985970039642136532488456723419015",
"20390689462465768179015406159760933671",
"188056662320727731132094500671426856976",
"121660567616920400602660036998032367724",
"76253456556846092907925626051863886274",
"31991388492554879220880081706975654513",
"214451849918493530588320390251805919331",
"232058019471892742095957425258090726737",
"125202706443727050779580343138981342578",
"96783941465209406786089061635375172874",
"294697614195988830534711634582200738022",
"210912234537376485982832260918849975762",
"33978973174275847840403798783722321562",
"327300570208651633521073833320682705253",
"120889001608639475301508481049952616535",
"280246557683833013346878899116569692597",
"291864821726445757431273784882133306184",
"315906418551813806396744483070189178160",
"283564345058804493761665138433758034093",
"90320661988413557258700904183091915621",
"200380481926178334448045172939849035638",
"313497015809954240279780448505493195343",
"50839374718800262705936164493630486093",
"270038963533175525759556702302403226451"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6db06aaea07bb7c8e33a425cf7b98bf29ee6056e",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2025-38262-42b4764f",
"target": {
"file": "drivers/tty/serial/uartlite.c"
}
},
{
"digest": {
"function_hash": "239438724097275611598332106628191831668",
"length": 145.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@685d29f2c5057b32c7b1b46f2a7d303b926c8f72",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-38262-66506362",
"target": {
"file": "drivers/tty/serial/uartlite.c",
"function": "ulite_init"
}
},
{
"digest": {
"function_hash": "239438724097275611598332106628191831668",
"length": 145.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5e4229d94792b40e750f30c92bcf7a3107c72ef",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-38262-9b6d95e0",
"target": {
"file": "drivers/tty/serial/uartlite.c",
"function": "ulite_init"
}
},
{
"digest": {
"function_hash": "287329581472722311696011546477898773718",
"length": 142.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6db06aaea07bb7c8e33a425cf7b98bf29ee6056e",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-38262-b325a24d",
"target": {
"file": "drivers/tty/serial/uartlite.c",
"function": "ulite_exit"
}
},
{
"digest": {
"function_hash": "239438724097275611598332106628191831668",
"length": 145.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9c905fdbba68a6d73d39a6b7de9b9f0d6c46df87",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-38262-b4b88026",
"target": {
"file": "drivers/tty/serial/uartlite.c",
"function": "ulite_init"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"264952985970039642136532488456723419015",
"20390689462465768179015406159760933671",
"188056662320727731132094500671426856976",
"121660567616920400602660036998032367724",
"76253456556846092907925626051863886274",
"31991388492554879220880081706975654513",
"214451849918493530588320390251805919331",
"232058019471892742095957425258090726737",
"125202706443727050779580343138981342578",
"96783941465209406786089061635375172874",
"294697614195988830534711634582200738022",
"210912234537376485982832260918849975762",
"33978973174275847840403798783722321562",
"327300570208651633521073833320682705253",
"120889001608639475301508481049952616535",
"280246557683833013346878899116569692597",
"291864821726445757431273784882133306184",
"315906418551813806396744483070189178160",
"283564345058804493761665138433758034093",
"90320661988413557258700904183091915621",
"200380481926178334448045172939849035638",
"313497015809954240279780448505493195343",
"50839374718800262705936164493630486093",
"270038963533175525759556702302403226451"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9c905fdbba68a6d73d39a6b7de9b9f0d6c46df87",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2025-38262-b9f09f3e",
"target": {
"file": "drivers/tty/serial/uartlite.c"
}
},
{
"digest": {
"function_hash": "287329581472722311696011546477898773718",
"length": 142.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9c905fdbba68a6d73d39a6b7de9b9f0d6c46df87",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-38262-dd3b34ce",
"target": {
"file": "drivers/tty/serial/uartlite.c",
"function": "ulite_exit"
}
},
{
"digest": {
"function_hash": "27381541210290950004315544359881738676",
"length": 2319.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6db06aaea07bb7c8e33a425cf7b98bf29ee6056e",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-38262-e47fe33c",
"target": {
"file": "drivers/tty/serial/uartlite.c",
"function": "ulite_probe"
}
},
{
"digest": {
"function_hash": "239438724097275611598332106628191831668",
"length": 145.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6db06aaea07bb7c8e33a425cf7b98bf29ee6056e",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-38262-eed767ba",
"target": {
"file": "drivers/tty/serial/uartlite.c",
"function": "ulite_init"
}
},
{
"digest": {
"function_hash": "27381541210290950004315544359881738676",
"length": 2319.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@685d29f2c5057b32c7b1b46f2a7d303b926c8f72",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-38262-f6fcdc28",
"target": {
"file": "drivers/tty/serial/uartlite.c",
"function": "ulite_probe"
}
}
]