Use-after-free in Linux kernel - CVE-2026-53384

Vulnerability identifier: #VU138878

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-53384

CWE-ID: CWE-416

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a use-after-free in the 8250_dw serial driver when handling a failed clock notifier registration during device probe. A local user can trigger the error path and access the stale port slot to cause a denial of service or execute arbitrary code.

The issue occurs because the 8250 port remains registered after probe failure while its associated driver data has already been freed.

Linux kernel
openEuler
Ubuntu
bpftool
python3-perf-debuginfo
python3-perf
perf-debuginfo
perf
kernel-tools-devel
kernel-tools-debuginfo
kernel-tools
kernel-headers
kernel-extra-modules
kernel-devel
kernel-debugsource
kernel-debuginfo
bpftool-debuginfo
kernel
kernel-source
linux (Ubuntu package)
linux-gcp-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
bpftool - update to 6.6.0-145.3.29.160
python3-perf-debuginfo - update to 6.6.0-145.3.29.160
python3-perf - update to 6.6.0-145.3.29.160
perf-debuginfo - update to 6.6.0-145.3.29.160
perf - update to 6.6.0-145.3.29.160
kernel-tools-devel - update to 6.6.0-145.3.29.160
kernel-tools-debuginfo - update to 6.6.0-145.3.29.160
kernel-tools - update to 6.6.0-145.3.29.160
kernel-headers - update to 6.6.0-145.3.29.160
kernel-extra-modules - update to 6.6.0-145.3.29.160
kernel-devel - update to 6.6.0-145.3.29.160
kernel-debugsource - update to 6.6.0-145.3.29.160
kernel-debuginfo - update to 6.6.0-145.3.29.160
bpftool-debuginfo - update to 6.6.0-145.3.29.160
kernel - update to 6.6.0-145.3.29.160
kernel-source - update to 6.6.0-145.3.29.160
linux (Ubuntu package) - addressed in versions 7.0.0-31.31, 7.0.0-31.31.1, 7.0.0-31.31~24.04.1, 7.0.0-1006.7, 7.0.0-1011.11~24.04.1, 7.0.0-1012.12, 7.0.0-1012.12~24.04.1
linux-gcp-7.0 (Ubuntu package) - update to 7.0.0-1011.11~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1013.13

• https://git.kernel.org/stable/c/07ffe414a708ae60551401cec5d727ed156b8caf
• https://git.kernel.org/stable/c/10fc708b4de7f86002d2d735a2dbf3b5b7f65692
• https://git.kernel.org/stable/c/3d205fe80f2181f0109150ad1fa06ee5bc046935
• https://git.kernel.org/stable/c/511d2b92f8d20de04acafab676150d26fb5c67f4
• https://git.kernel.org/stable/c/778b9dda4b24005a27bcd9c35c110bf8d7f259ca
• https://git.kernel.org/stable/c/ccdf4510a3873b14e5e348cdb038717996f09fda
• https://git.kernel.org/stable/c/d72650a4f334581b23a1892b888a4cb1be142f76

• Use-after-free in Linux kernel serial 8250 driver
• openEuler 24.03 LTS SP3 update for kernel
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux
• Ubuntu update for linux-gcp-7.0