---
id: CVE-2026-98747
title: 'serial: core: fix NULL pointer dereference in serial_core_unregister_port()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  serial: core: fix NULL pointer dereference in serial_core_unregister_port()

  port->port_dev is NULL when no port device is installed: it is cleared
  on teardown, and nev…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 84a9582fd203063cd4d301204971ff2cd8327f1a <
    54abbb862366dcaf1f22f1e968358147b7d0547d
  - >-
    Linux >= 84a9582fd203063cd4d301204971ff2cd8327f1a <
    499485a67fbacf4d9afbdb43522388c64f853428
  - Linux 6.5
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:47:32.607Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98747'
references:
  - url: 'https://git.kernel.org/stable/c/54abbb862366dcaf1f22f1e968358147b7d0547d'
  - url: 'https://git.kernel.org/stable/c/499485a67fbacf4d9afbdb43522388c64f853428'
tags:
  - cve.org
ingestedAt: '2026-10-18T16:47:32.501Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

serial: core: fix NULL pointer dereference in serial_core_unregister_port()

port->port_dev is NULL when no port device is installed: it is cleared
on teardown, and never set if registration failed before
serial_core_port_device_add().  serial_core_unregister_port() passes it
straight to serial_core_get_ctrl_dev(), which dereferences it:

  KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047]
  RIP: serial_core_unregister_port
  Call Trace:
   serial8250_unregister_port
   serial8250_remove
   unbind_store

Return early when there is no port device, and read port->port_dev
under port_mutex.

Also clear port->port_dev on the serial_core_register_port() error
path, where the port device has already been removed.

## Affected

- `Linux >= 84a9582fd203063cd4d301204971ff2cd8327f1a < 54abbb862366dcaf1f22f1e968358147b7d0547d`
- `Linux >= 84a9582fd203063cd4d301204971ff2cd8327f1a < 499485a67fbacf4d9afbdb43522388c64f853428`
- `Linux 6.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.