CVE-2026-53384
Published: July 19, 2026· Updated: Jul 20, 2026
Official Description
In the Linux kernel, the following vulnerability has been resolved:
serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
dw8250_probe() registers the 8250 port via serial8250_register_8250_port()
and then, if the device has a clock, registers a clock notifier. If
clk_notifier_register() fails, probe returns the error but leaves the
8250 port registered. The matching serial8250_unregister_port() lives
in dw8250_remove(), which is not called when probe fails, so the port
slot stays occupied until the device is rebound or the system is
rebooted. The devm-allocated driver data is freed while the port still
references it (via the saved private_data and serial_in/serial_out
callbacks), so any access to that port slot before a rebind is a
use-after-free hazard.
Unregister the port on the clk_notifier_register() error path.
Risk Analysis
A use-after-free vulnerability exists in the Linux kernel's 8250 serial driver when probe fails during clock notifier registration. This can lead to memory corruption if the port is accessed after the driver data is freed. The critical CVSS score indicates a high risk to system integrity.
No public exploit is known, and it is not in the KEV catalog. The vulnerability is remotely exploitable.
Update the Linux kernel to a version that ensures the 8250 port is properly unregistered if probe fails.
Technical Analysis
CVE-2026-53384 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.
A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.
CVSS v3.1 Vector Breakdown
Affected Vendors & Products
Exploit & PoC Resources
All References (7)
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2026-53384 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts