CVE-2026-23115: Linux Kernel Race Condition Vulnerability

CVE-2026-23115 Overview

CVE-2026-23115 is a race condition vulnerability in the Linux kernel's serial subsystem. The vulnerability exists because the tty->port configuration is not properly set before uart_configure_port() is called, which allows user-space processes to open the console without the TTY being properly linked to the driver. This issue was introduced when commit bfc467db60b7 incorrectly removed the tty_port_link_device() function call, deeming it redundant when it was actually essential for preventing this race condition.

Critical Impact
This vulnerability can cause kernel warnings and potentially crash the kernel when user-space attempts to open a serial console device before the TTY port is properly configured on systems with fast boot times.

Affected Products

Linux kernel with affected serial driver configurations
Qualcomm SoC devices using qcom_geni_serial driver
Systems with fast boot times and serial console enabled

Discovery Timeline

2026-02-14 - CVE CVE-2026-23115 published to NVD
2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-23115

Vulnerability Analysis

This race condition vulnerability occurs in the Linux kernel's serial TTY subsystem during device initialization. The root cause stems from an incorrect code removal that reintroduced a previously fixed timing issue between driver initialization and user-space console access.

The problematic sequence occurs when qcom_geni_serial_probe() calls uart_add_one_port(), which subsequently invokes serial_core_register_port(). Within this call chain, uart_configure_port() triggers register_console(), making the console available to user-space. However, the tty_port_link_device() function that sets driver->ports[idx] is only called afterward in tty_port_register_device_attr_serdev().

During fast boot scenarios, particularly on Qualcomm SoC devices with minimal enabled peripherals, user-space processes (such as systemd) can attempt to open the console device between the register_console() call and the tty_port_link_device() call. When this happens, tty_init_dev() finds driver->ports[idx] is NULL, triggering a kernel warning indicating the driver does not properly set tty->port.

The vulnerability is consistently reproducible on Qualcomm SoC systems with most devices disabled (enabling faster boot) and a single serial device configured as the console. The kernel produces a warning trace originating from tty_init_dev.part.0 at drivers/tty/tty_io.c:1414.

Root Cause

The vulnerability was introduced by commit bfc467db60b7 ("serial: remove redundant tty_port_link_device()") which incorrectly removed the tty_port_link_device() call. This function had been explicitly added in commit fb2b90014d78 ("tty: link tty and port before configuring it as console") specifically to prevent this race condition. The removal essentially reverted the original fix without properly addressing the underlying timing issue between console registration and port linking.

Attack Vector

The attack vector for this vulnerability is local. It requires specific timing conditions during system boot where user-space processes attempt to access the serial console before the kernel completes device initialization. While this is primarily a stability issue rather than a security exploit, it demonstrates improper resource synchronization in kernel code paths. The vulnerability manifests through the following race condition sequence:

Driver probe function initiates port registration
uart_configure_port() calls register_console(), exposing the console
User-space (systemd) attempts to open the console
tty_init_dev() executes before tty_port_link_device() completes
driver->ports[idx] is found NULL, triggering kernel warning

Detection Methods for CVE-2026-23115

Indicators of Compromise

Kernel warning messages containing "tty_init_dev: ttyMSM driver does not set tty->port"
Warning traces originating from drivers/tty/tty_io.c:1414
Stack traces showing tty_init_dev.part.0 followed by tty_open and chrdev_open
System logs indicating TTY initialization failures during boot

Detection Strategies

Monitor kernel logs for warnings related to TTY port initialization failures
Review dmesg output during system boot for serial driver error messages
Check for TAINTED kernel flags indicating CPU_OUT_OF_SPEC conditions
Analyze boot timing on Qualcomm SoC systems with serial console configurations

Monitoring Recommendations

Enable kernel logging for TTY subsystem events
Monitor systems with fast boot configurations and serial consoles enabled
Track warning counts in /var/log/kern.log or journalctl for TTY-related issues
Implement automated kernel log parsing for race condition indicators

How to Mitigate CVE-2026-23115

Immediate Actions Required

Apply the kernel patches available from the official kernel.org repositories
Update to a patched kernel version that reverts the problematic commit
Consider temporarily disabling serial console on affected fast-boot systems
Review system boot configuration to identify exposure to this race condition

Patch Information

The fix for CVE-2026-23115 reverts commit bfc467db60b7 to restore the proper tty_port_link_device() call sequence. This ensures that tty->port is configured before uart_configure_port() is called, preventing user-space from opening the console without the TTY being properly linked to the driver. Patches are available from the official kernel.org repositories:

Workarounds

Delay user-space service startup that accesses serial console during boot
Add boot delays on systems with very fast initialization to allow driver completion
Temporarily use alternative console configurations (framebuffer, netconsole) on affected systems
Disable unnecessary serial console registration on embedded devices with fast boot times