HOMEVULNERABILITIESCVE-2026-53384
CRITICAL

CVE-2026-53384

Published: July 19, 2026· Updated: Jul 20, 2026

9.8
CVSS v3.1
EPSS:0.17%probability of exploitation in 30 daysPercentile:6.9th

Official Description

In the Linux kernel, the following vulnerability has been resolved:

serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails

dw8250_probe() registers the 8250 port via serial8250_register_8250_port()

and then, if the device has a clock, registers a clock notifier. If

clk_notifier_register() fails, probe returns the error but leaves the

8250 port registered. The matching serial8250_unregister_port() lives

in dw8250_remove(), which is not called when probe fails, so the port

slot stays occupied until the device is rebound or the system is

rebooted. The devm-allocated driver data is freed while the port still

references it (via the saved private_data and serial_in/serial_out

callbacks), so any access to that port slot before a rebind is a

use-after-free hazard.

Unregister the port on the clk_notifier_register() error path.

NVD Source

Risk Analysis

A use-after-free vulnerability exists in the Linux kernel's 8250 serial driver when probe fails during clock notifier registration. This can lead to memory corruption if the port is accessed after the driver data is freed. The critical CVSS score indicates a high risk to system integrity.

No public exploit is known, and it is not in the KEV catalog. The vulnerability is remotely exploitable.

Recommended Action

Update the Linux kernel to a version that ensures the 8250 port is properly unregistered if probe fails.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2026-53384 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.

CVSS v3.1 Vector Breakdown

Exploitability
Attack VectorNetwork
Attack ComplexityLow
Privileges Req.None
User InteractionNone
ScopeUnchanged
Impact
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Vendors & Products

Mentioned vendors (from description):
Linux
CPE data not yet available in NVD for this CVE.

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time
External links open in a new tab. Always verify in a controlled environment before use.

All References (7)

Quick Facts

CVE IDCVE-2026-53384
CVSS Score9.8 / 10
SeverityCRITICAL
CISA KEVNo
EPSS (30d)0.17%
PublishedJul 19, 2026

Recommended Actions

  • Apply vendor patches immediately
  • Monitor CVE-2026-53384 in threat intel feeds
  • Review IDS/IPS signatures for exploitation attempts
Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWatch. CVE data is provided under the NVD usage policy.