CVE-2026-89740: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89740 Overview

CVE-2026-89740 is a Linux kernel vulnerability in the i.MX serial UART driver. The imx_uart_probe() function publishes its devm-allocated port into the global imx_uart_ports[] table before calling uart_add_one_port(). The table entry is not cleared when port addition fails or after removal, leaving a dangling pointer. A sibling probe can then register the shared console through the stale entry, producing a use-after-free condition. The issue was reproduced under Kernel Address Sanitizer (KASAN) on QEMU mcimx6ul-evk by unbinding a sibling UART, unbinding the console UART, and rebinding the sibling.

Critical Impact
A local attacker with device-binding privileges can trigger a use-after-free in kernel context on i.MX-based systems, potentially leading to kernel memory corruption or privilege escalation.

Affected Products

Linux kernel serial: imx driver (drivers/tty/serial/imx.c)
i.MX-family SoC platforms using the imx-uart driver
Stable branches referenced by fix commits 28b93220, 681696ae, 7429dce5, and 8b0b29fd

Discovery Timeline

2026-09-11 - CVE-2026-89740 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-89740

Vulnerability Analysis

The i.MX UART driver maintains a global lookup table, imx_uart_ports[], that the serial console setup path consults to resolve a port by line number. Because the console can be attached from a sibling device probe, the driver publishes each port into the table early in imx_uart_probe(), before uart_add_one_port() completes registration.

The defect lies in lifecycle management. When uart_add_one_port() fails, or when the device is removed through uart_remove_one_port(), the corresponding entry in imx_uart_ports[] is not cleared. The slot continues to reference memory that was released by the devres framework when the underlying platform_device was unbound.

A subsequent sibling probe or console setup that walks the table dereferences the stale pointer. Reproduction under KASAN on QEMU mcimx6ul-evk confirmed the use-after-free by unbinding one UART, unbinding the console UART, and rebinding the sibling.

Root Cause

The root cause is a missing lifetime contract between the imx_uart_ports[] global table and the devm-managed port allocation. Ownership is effectively split: the table holds a raw pointer whose backing memory is freed by device unbind, without any clearing step or serialization to prevent concurrent readers from observing the dangling slot.

Attack Vector

Exploitation requires local access with the ability to bind and unbind platform devices through sysfs, typically restricted to root or users with CAP_SYS_ADMIN. An attacker triggers the race by unbinding a sibling UART, unbinding the console UART, and rebinding the sibling to force the console setup path to dereference the stale entry. A duplicate-line probe can also clobber an active port, corrupting kernel state.

The upstream fix keeps the entry valid through uart_remove_one_port() and clears it afterward. Port addition and removal are serialized together with their table updates so sibling operations cannot interleave. An occupied slot is now rejected rather than overwritten during a duplicate-line probe. Refer to the kernel commits 28b93220, 681696ae, 7429dce5, and 8b0b29fd for the patch series.

Detection Methods for CVE-2026-89740

Indicators of Compromise

KASAN reports referencing imx_uart_probe, imx_uart_remove, or imx_console_setup with a use-after-free trace on imx_uart_ports[].
Kernel oops or panic messages originating from the serial: imx subsystem shortly after driver bind or unbind events.
Unexpected bind/unbind writes to /sys/bus/platform/drivers/imx-uart/ from non-administrative sources.

Detection Strategies

Audit sysfs driver-binding activity for the imx-uart platform driver and correlate with subsequent kernel warnings.
Deploy KASAN-enabled kernels in test and validation environments running i.MX targets to surface the use-after-free during regression testing.
Monitor kernel ring buffer output (dmesg) for slab-use-after-free and BUG: markers tied to the serial subsystem.

Monitoring Recommendations

Forward kernel logs from i.MX-based devices to a centralized log pipeline and alert on serial driver faults.
Track process activity that writes to platform driver bind/unbind interfaces using Linux audit rules on /sys/bus/platform/drivers/.
Baseline expected UART bind/unbind events per device fleet and flag anomalous sequences that match the reproducer pattern.

How to Mitigate CVE-2026-89740

Immediate Actions Required

Apply the upstream stable kernel updates that include commits 28b93220, 681696ae, 7429dce5, and 8b0b29fd to the serial: imx driver.
Inventory deployed devices that use i.MX SoCs and prioritize firmware or kernel updates for those platforms.
Restrict access to platform driver bind/unbind sysfs interfaces to trusted administrative accounts only.

Patch Information

The fix is available in the mainline Linux kernel and backported to stable branches through the four referenced commits. The patch series keeps the imx_uart_ports[] entry valid through uart_remove_one_port(), clears the slot afterward, serializes port addition and removal with their table updates, and rejects an occupied slot during a duplicate-line probe. Consult the Linux stable kernel repository for the specific commit applied to your branch.

Workarounds

Prevent unprivileged unbinding of UART devices by hardening sysfs permissions and reviewing udev rules that expose driver control.
Avoid dynamic bind/unbind operations on i.MX UART devices in production until the patch is applied.
Disable unused i.MX UART instances in the device tree to reduce the number of ports available for sibling probe races.

bash

# Verify the running kernel version and confirm the patched commit is present
uname -r
zcat /proc/config.gz | grep CONFIG_SERIAL_IMX

# Restrict access to platform driver bind/unbind interfaces
chmod 600 /sys/bus/platform/drivers/imx-uart/bind
chmod 600 /sys/bus/platform/drivers/imx-uart/unbind