In the Linux kernel serial driver 8250_dw, the dw8250_probe() function registers an 8250 port and then attempts to register a clock notifier if the device has a clock. If clk_notifier_register() fails, the probe function returns an error but does not unregister the previously registered 8250 port. The corresponding unregister function is only called during device removal, which does not occur on probe failure. As a result, the port slot remains occupied and references freed driver data, creating a use-after-free vulnerability. The fix involves unregistering the port if clk_notifier_register() fails to prevent stale references.

The vulnerability can lead to use-after-free conditions where the kernel accesses freed memory via the stale 8250 port slot. This may cause system instability or crashes. There is no evidence of known exploits in the wild. The impact is limited to affected Linux kernel serial driver instances where the failure scenario occurs.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability description indicates the issue has been resolved in the Linux kernel source by unregistering the port on clk_notifier_register() failure. Users should monitor official Linux kernel advisories and apply updates when available.