CVE-2026-63876 Overview
CVE-2026-63876 is a null pointer dereference vulnerability in the Linux kernel's zs serial driver for the DECstation Z85C30 SCC controller. The flaw occurs during initialization of the first serial port, when serial_base_ctrl_add() dereferences a pointer derived from a null parent device pointer. The result is a kernel oops during early boot on affected MIPS-based DECstation systems. The upstream fix converts the driver to use a platform device, ensuring a valid parent device exists before port registration.
Critical Impact
The bug triggers a kernel paging request crash at virtual address 0000002c during boot, preventing affected systems from initializing serial console output and completing startup.
Affected Products
- Linux kernel zs (Zilog Z85C30 SCC) serial driver
- DECstation platforms using the Z85C30 serial controller
- MIPS-based systems relying on legacy SCC serial probing
Discovery Timeline
- 2026-07-19 - CVE-2026-63876 published to NVD
- 2026-07-19 - Last updated in NVD database
Technical Details for CVE-2026-63876
Vulnerability Analysis
The defect resides in the DECstation Z85C30 serial driver (drivers/tty/serial/zs.c). During zs_init(), the driver calls serial_core_register_port(), which in turn invokes serial_base_ctrl_add(). That function dereferences the parent device of the UART port. Under the legacy probing path used by the driver, no parent device is assigned, so the parent pointer is null. Reading a field at offset 0x2c from that null pointer generates an unhandled kernel paging request and an oops with epc == 803ab00c inside serial_base_ctrl_add+0x78/0xf4. The crash aborts kernel initialization on affected hardware.
Root Cause
The root cause is a null pointer dereference [CWE-476] introduced by the serial core requiring every registered port to have a valid parent device. The zs driver used legacy probing and did not create a device object, so the port's parent field remained null when serial_base_ctrl_add() accessed it. Legacy probing is no longer a supported mechanism for exposing device topology to the serial core.
Attack Vector
The issue is triggered automatically by kernel boot on hardware containing a Z85C30 SCC, not by user input or a remote actor. Practical impact is limited to denial of service through failed boot on the narrow set of legacy MIPS/DECstation systems that build the zs driver. There is no known remote or local exploitation path beyond hardware presence.
No verified proof-of-concept code is available. The crash signature reported upstream shows the failing call chain: zs_init → serial_core_register_port → serial_base_ctrl_add, faulting on a dereference of the port's parent device pointer.
Detection Methods for CVE-2026-63876
Indicators of Compromise
- Kernel oops messages referencing serial_base_ctrl_add+0x78/0xf4 during boot
- Unable to handle kernel paging request at virtual address 0000002c in early boot logs
- Failure to bring up the DECstation Z85C30 serial driver on MIPS hardware
Detection Strategies
- Review boot logs from serial console or dmesg captures for the Oops[#1] signature tied to zs_init in the call trace.
- Inventory kernel builds to identify images that enable CONFIG_SERIAL_ZS on unpatched stable branches.
- Compare running kernel commit hashes against the fixed commits 237dc8c, 4dc9f15, 6a83d5e, 7cac59d, and bb20404 in the stable tree.
Monitoring Recommendations
- Aggregate kernel crash reports from lab and production DECstation hardware into a central log store for signature matching.
- Alert on repeated boot failures on the same host, which may indicate an unpatched kernel triggering the null dereference.
- Track upstream stable kernel advisories for the zs driver to catch follow-on fixes.
How to Mitigate CVE-2026-63876
Immediate Actions Required
- Update to a Linux stable kernel that includes the platform device conversion for the zs driver.
- On any DECstation systems still in service, avoid enabling CONFIG_SERIAL_ZS on unpatched kernels.
- Validate boot on a non-production host before rolling the updated kernel across the fleet.
Patch Information
The fix converts the zs driver to a platform device, assigns it as the port's parent, uses platform_driver_probe() to arbitrate the shared TTY major number with the dz driver, and requests only the address span actually used within the slot. Relevant upstream commits are Kernel Git Commit 237dc8c, Kernel Git Commit 4dc9f15, Kernel Git Commit 6a83d5e, Kernel Git Commit 7cac59d, and Kernel Git Commit bb20404.
Workarounds
- Disable the zs driver in the kernel configuration by unsetting CONFIG_SERIAL_ZS where the SCC serial console is not required.
- Use an alternative serial driver, such as dz, on systems where the hardware permits, since only one of the two will be present at a time.
- Boot with an earlier stable kernel that predates the parent-device requirement in serial_base_ctrl_add() until a patched build is deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
