AZL-64853
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-64853.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/AZL-64853
- Upstream
- Published
- 2025-07-09T11:15:28Z
- Modified
- 2026-04-01T05:20:25.092242Z
- Summary
- CVE-2025-38262 affecting package kernel for versions less than 6.6.96.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
tty: serial: uartlite: register uart driver in init
When two instances of uart devices are probing, a concurrency race can occur. If one thread calls uartregisterdriver function, which first allocates and assigns memory to 'uartstate' member of uartdriver structure, the other instance can bypass uart driver registration and call uliteassign. This calls uartaddoneport, which expects the uart driver to be fully initialized. This leads to a kernel panic due to a null pointer dereference:
[ 8.143581] BUG: kernel NULL pointer dereference, address: 00000000000002b8 [ 8.156982] #PF: supervisor write access in kernel mode [ 8.156984] #PF: errorcode(0x0002) - not-present page [ 8.156986] PGD 0 P4D 0 ... [ 8.180668] RIP: 0010:mutexlock+0x19/0x30 [ 8.188624] Call Trace: [ 8.188629] ? __diebody.cold+0x1a/0x1f [ 8.195260] ? pagefault_oops+0x15c/0x290 [ 8.209183] ? _irqresolvemapping+0x47/0x80 [ 8.209187] ? excpagefault+0x64/0x140 [ 8.209190] ? asmexcpagefault+0x22/0x30 [ 8.209196] ? mutexlock+0x19/0x30 [ 8.223116] uartaddoneport+0x60/0x440 [ 8.223122] ? procttyregisterdriver+0x43/0x50 [ 8.223126] ? ttyregisterdriver+0x1ca/0x1e0 [ 8.246250] uliteprobe+0x357/0x4b0 [uartlite]
To prevent it, move uart driver registration in to init function. This will ensure that uart_driver is always registered when probe function is called.
- References