CVE-2026-97480 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems that utilize the serial 8250 driver. These stakeholders should assess their exposure to this vulnerability and apply patches to mitigate the risk. Additionally, Linux-based system administrators and security teams should be aware of the potential impact on their systems and take appropriate measures to ensure their system's stability and security.

Why it matters

This vulnerability in the Linux kernel's serial 8250 driver can cause system instability or crashes, potentially leading to denial-of-service attacks. Linux kernel developers, maintainers, and users of Linux-based systems should assess exposure and apply patches to mitigate the risk.

• Potential kernel crashes or instability due to NULL pointer dereferences
• Increased risk of denial-of-service (DoS) attacks or system failures
• Need for thorough testing and validation of kernel patches to ensure vulnerability fix

Technical summary

The Linux kernel's serial 8250 driver is vulnerable to a NULL pointer dereference when registering a serial port without a parent device. The driver's failure to handle NULL ->dev fields in both the uart slot and up structure leads to a kernel crash when has_acpi_companion() is called. This issue arises from the driver's failure to properly handle cases where both the existing uart slot and the up structure have a NULL ->dev field. As a result, the has_acpi_companion() function may dereference a NULL pointer, leading to a kernel crash. The vulnerability can cause system instability or crashes, potentially leading to denial-of-service attacks. Linux kernel developers, maintainers, and users of Linux-based The

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided kernel patches to address the vulnerability
• Ensure that all Linux kernel versions are up-to-date with the latest security patches
• Monitor system logs for potential crashes or errors related to the serial 8250 driver
• Perform thorough testing and validation of kernel patches to ensure vulnerability fix
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source code analysis indicate a NULL pointer dereference vulnerability in the Linux kernel's serial 8250 driver. The issue is triggered when registering a serial port without a parent device, causing the has_acpi_companion() function to dereference a NULL pointer.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.