In the Linux kernel, the following vulnerability has been resolved:

tty: clear cdev pointer after cdev_add() failure

tty_cdev_add() drops the cdev reference when cdev_add() fails, but
leaves driver->cdevs[index] pointing to freed memory.
tty_unregister_device() later passes that stale pointer to cdev_del(),
causing a use-after-free.

Clear the slot after dropping the reference.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
c1a752ba2d6b8a52879c7ab637cff38359ea9827 affected < fb1de260033c215dba438973d82b48562bdc86bb
c1a752ba2d6b8a52879c7ab637cff38359ea9827 affected < e9e64dd02fd68776afda00777591eca0c3984285
c1a752ba2d6b8a52879c7ab637cff38359ea9827 affected < 33a44333a9dfda044b0e233399b12ead7f8a90ae
c1a752ba2d6b8a52879c7ab637cff38359ea9827 affected < d331c63570af61ef7aaf516b64a8d6f47518a3a4
c1a752ba2d6b8a52879c7ab637cff38359ea9827 affected < a83fcddf3c75d004f12aa13555bb73da19fb75a9
c1a752ba2d6b8a52879c7ab637cff38359ea9827 affected < 4f6bd79bb7e55095f09bec9b4eb6c09df1306116
c1a752ba2d6b8a52879c7ab637cff38359ea9827 affected < 5c5a795bf6248fe96f96dd9fd79d66bbb4a92077
c1a752ba2d6b8a52879c7ab637cff38359ea9827 affected < 6645856f0df3aeecd45519cb611415b4b89c2223
Linux Linux affected
Version Status Constraints
4.3 affected —
0 unaffected < 4.3
5.10.270 unaffected ≤ 5.10.*
5.15.221 unaffected ≤ 5.15.*
6.1.188 unaffected ≤ 6.1.*
6.6.157 unaffected ≤ 6.6.*
6.12.110 unaffected ≤ 6.12.*
6.18.52 unaffected ≤ 6.18.*
7.2.6 unaffected ≤ 7.2.*
7.3-rc1 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/33a44333a9dfda044b0e233399b12ead7f8a90ae cve-icon cve-icon
https://git.kernel.org/stable/c/4f6bd79bb7e55095f09bec9b4eb6c09df1306116 cve-icon cve-icon
https://git.kernel.org/stable/c/5c5a795bf6248fe96f96dd9fd79d66bbb4a92077 cve-icon cve-icon
https://git.kernel.org/stable/c/6645856f0df3aeecd45519cb611415b4b89c2223 cve-icon cve-icon
https://git.kernel.org/stable/c/a83fcddf3c75d004f12aa13555bb73da19fb75a9 cve-icon cve-icon
https://git.kernel.org/stable/c/d331c63570af61ef7aaf516b64a8d6f47518a3a4 cve-icon cve-icon
https://git.kernel.org/stable/c/e9e64dd02fd68776afda00777591eca0c3984285 cve-icon cve-icon
https://git.kernel.org/stable/c/fb1de260033c215dba438973d82b48562bdc86bb cve-icon cve-icon
History

Thu, 17 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: tty: clear cdev pointer after cdev_add() failure tty_cdev_add() drops the cdev reference when cdev_add() fails, but leaves driver->cdevs[index] pointing to freed memory. tty_unregister_device() later passes that stale pointer to cdev_del(), causing a use-after-free. Clear the slot after dropping the reference.
Title tty: clear cdev pointer after cdev_add() failure
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-17T16:08:47.462Z

Reserved: 2026-09-11T19:38:34.803Z

Link: CVE-2026-90334

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-17T17:17:31.937

Modified: 2026-09-17T17:17:31.937

Link: CVE-2026-90334

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.