CVE-2023-54220

Root

Cause

When a hardware-specific 8250 serial driver is unloaded, the port->pm function pointer is not cleared, leaving a dangling reference. After the driver is removed, a subsequent call to uart_change_pm() (e.g., during uart_hangup()) invokes port->pm is still set to the now-unloaded driver's callback. This causes the kernel to jump to an invalid address, resulting in an oops. A prior fix (commit 04e82793f068) only reinitialized port->ops, but did not address port->pm [1][2][3][4].

Exploitation

An attacker would need the ability to unload a) load and unload a hardware-specific 8250 driver, and b) trigger a hangup on the corresponding serial port. This requires local access and the ability to manipulate kernel modules. No special privileges beyond the ability to unload the driver are needed; the oops occurs automatically during normal port teardown.

Impact

A successful trigger results in a kernel oops (NULL pointer dereference or invalid page access), causing a denial of service (system crash or hang). There is no evidence of code execution or privilege escalation from this bug.

Mitigation

The fix is to clear port->pm (set it to NULL) when a hardware-specific 8250 driver is unbound, ensuring that serial8250_pm() falls back to serial8250_do_pm() instead of calling the stale pointer. The patch has been applied to the stable kernel trees [1][2][3][4]. Users should update to a kernel containing the fix.