In the Linux kernel, the following vulnerability has been resolved: serial: core: fix NULL pointer dereference in serial_core_unregister_port()… (CVE-2026-98747)

The vulnerability in the Linux kernel's serial core involves a NULL pointer dereference in serial_core_unregister_port(). Specifically, port->port_dev can be NULL if no port device is installed or if registration failed before serial_core_port_device_add(). The function serial_core_unregister_port() calls serial_core_get_ctrl_dev() with this NULL pointer, causing a kernel NULL pointer dereference detected by KASAN. The patch adds an early return when port->port_dev is NULL and ensures port->port_dev is read under port_mutex. It also clears port->port_dev on error paths during registration to prevent stale pointers.

This vulnerability can cause a kernel NULL pointer dereference, leading to a denial of service via kernel crash. There is no indication of privilege escalation or code execution. The impact is limited to system stability and availability.

A fix has been implemented in the Linux kernel to address this issue by adding checks for NULL pointers and proper synchronization. Users should apply the official kernel updates containing this fix. No additional mitigations are indicated.