CVE-2026-63877 Overview
CVE-2026-63877 is a null pointer dereference vulnerability in the Linux kernel's serial: dz driver used on DECstation systems. The flaw occurs during initialization of the first serial port when the driver dereferences a pointer derived from a null parent device reference. Legacy probing provided no parent device, causing __dev_fwnode() to operate on invalid memory during serial_base_ctrl_add(). The result is a kernel oops early in bootstrap with BadVA: 000000bc, halting system startup on affected hardware. The upstream fix converts the driver to use a platform device, providing a valid parent for serial core registration.
Critical Impact
The vulnerability triggers a kernel oops during boot on DECstation systems using the DZ serial driver, preventing successful system initialization.
Affected Products
- Linux kernel serial: dz driver (DECstation DZ serial)
- Linux kernel versions prior to the referenced stable commits
- Systems using legacy probing for the DZ TTY driver
Discovery Timeline
- 2026-07-19 - CVE CVE-2026-63877 published to NVD
- 2026-07-19 - Last updated in NVD database
Technical Details for CVE-2026-63877
Vulnerability Analysis
The DZ serial driver on DECstation platforms registered its console port through serial_core_register_port() without providing a valid parent device. During registration, serial_base_ctrl_add() invoked __dev_fwnode() on the port's parent pointer. Because legacy probing did not populate a parent device, this dereference operated on a null-derived address, triggering a paging fault at virtual address 0x000000bc.
The call trace shows the fault path: dz_init → serial_core_register_port → serial_base_ctrl_add → __dev_fwnode. Execution halts in swapper/0 (PID 1) with an unhandled kernel paging request, producing an oops before the system can complete boot. This class of defect corresponds to [CWE-476] null pointer dereference within a kernel driver initialization path.
Root Cause
The root cause is the absence of a parent device in the legacy probe path of the dz driver. Modern serial core registration expects a valid struct device parent so that firmware node lookups succeed. Legacy probing bypassed the driver model, leaving the parent pointer unusable when serial core routines attempted to walk it.
Attack Vector
The defect is a local reliability issue affecting boot on DECstation hardware with the DZ serial driver enabled. It is triggered automatically during kernel initialization rather than through an external attack vector. No network exposure or authenticated user interaction is required, because the fault occurs before userspace exists.
See the upstream fix at the kernel.org stable commit for the code-level remediation.
Detection Methods for CVE-2026-63877
Indicators of Compromise
- Kernel oops entries referencing __dev_fwnode+0x0/0xc and serial_base_ctrl_add in boot logs
- Boot halt after the message DECstation DZ serial driver version 1.04
- Unable to handle kernel paging request at virtual address 000000bc in dmesg or serial console output
Detection Strategies
- Inventory kernel build configurations that enable the dz serial driver on DECstation targets and verify patch level.
- Monitor kernel version strings against the fixed commits 2ff0401ffdda, 5c9fb95c8d64, 5d7a49d60b8f, 6f59646229490, and c9e78361fe92.
- Capture serial console logs during boot to detect the specific oops signature associated with this defect.
Monitoring Recommendations
- Alert on any Oops[#1] event during kernel initialization referencing the serial subsystem.
- Track kernel package updates on affected embedded and legacy MIPS systems to confirm remediation deployment.
- Correlate boot-failure telemetry with kernel build metadata to identify unpatched hosts.
How to Mitigate CVE-2026-63877
Immediate Actions Required
- Apply the stable kernel updates that convert the dz driver to use a platform device.
- Rebuild and deploy kernels for any DECstation or MIPS-based systems still in service using the DZ serial driver.
- Validate boot on affected hardware after patching to confirm the oops no longer occurs.
Patch Information
The fix is available in Linux stable branches through the following commits: 2ff0401ffdda, 5c9fb95c8d64, 5d7a49d60b8f, 6f5964622949, and c9e78361fe92. The patch registers a platform device as the parent, adjusts resource handling to request only the address span used within the slot, and uses platform_driver_probe() to arbitrate TTY major number ownership between the dz and zs drivers. Transmitter draining also switches from udelay() to fsleep() to avoid extended busy-waiting.
Workarounds
- Disable the dz driver in kernel configuration on systems where DECstation serial support is not required.
- Boot with an alternative console when possible until the patched kernel is deployed.
# Verify running kernel does not include the vulnerable pre-platform-device dz driver
uname -r
zgrep -E 'CONFIG_SERIAL_DZ' /proc/config.gz 2>/dev/null || \
grep -E 'CONFIG_SERIAL_DZ' /boot/config-$(uname -r)
# Confirm the fix commit is present in the kernel source tree
git -C /usr/src/linux log --oneline | grep -E '2ff0401ffdda|5c9fb95c8d64|5d7a49d60b8f|6f5964622949|c9e78361fe92'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
