The Linux kernel vulnerability CVE-2026-63876 involves the serial zs driver crashing the kernel when initializing the first serial port. The root cause was dereferencing a pointer derived from a null pointer to the port's parent device under legacy probing. The fix converts the driver to use a platform device as the port's parent device, updates resource management to request only the actual address span, and uses platform_driver_probe() to manage device binding and major device number claims. This approach prevents conflicts between dz and SCC drivers and avoids the null pointer dereference that caused the crash. The console handover now occurs later in the bootstrap process due to this change.

The vulnerability causes a kernel crash (Oops) during initialization of the first serial port, potentially leading to system instability or denial of service. No information about code execution or privilege escalation is provided. The impact is limited to kernel stability during boot or serial port initialization.

A fix is available and has been applied by converting the serial zs driver to use a platform device instead of legacy probing. Users should update to a Linux kernel version that includes this fix. Since no vendor advisory or patch links are provided, check the official Linux kernel repositories or distribution updates for the patched version. Patch status is not yet confirmed in this data — verify with vendor advisories for current remediation guidance.