In the Linux kernel, the following vulnerability has been resolved:
w1: fix NULL pointer dereference in probe
The w1_uart_probe() function calls w1_uart_serdev_open() (which includes devm_serdev_device_open()) before setting the client ops via serdev_device_set_client_ops(). This ordering can trigger a NULL pointer dereference in the serdev controller's receive_buf handler, as it assumes serdev->ops is valid when SERPORT_ACTIVE is set.
This is similar to the issue fixed in commit 5e700b384ec1 ("platform/chrome: cros_ec_uart: properly fix race condition") where devm_serdev_device_open() was called before fully initializing the device.
Fix the race by ensuring client ops are set before enabling the port via w1_uart_serdev_open().
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Suse | — | Upgrade kernel-source-azureUpgrade kernel-source-vanillaUpgrade kernel-devel-azureUpgrade kernel-default-livepatchUpgrade kernel-64kb-develUpgrade kernel-kvmsmall-develUpgrade kernel-64kbUpgrade kernel-kvmsmallUpgrade kernel-default-develUpgrade kernel-default-vdsoUpgrade kernel-sourceUpgrade kernel-develUpgrade kernel-azure-develUpgrade kernel-zfcpdumpUpgrade kernel-azureUpgrade kernel-defaultUpgrade kernel-64kb-extraUpgrade kernel-symsUpgrade kernel-macrosUpgrade kernel-default-extraUpgrade kernel-azure-vdsoUpgrade kernel-azure-extraUpgrade kernel-docsUpgrade kernel-kvmsmall-vdsoUpgrade kernel-obs-qaUpgrade kernel-docs-html | Dec 5, 2025 | Dec 5, 2025 |
| Ubuntu | — | Upgrade linux-image-6.11.0-1018-azure-fdeUpgrade linux-image-azure-fde-6.11Upgrade linux-image-6.14.0-1007-azure-fdeUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-awsUpgrade linux-image-6.11.0-1024-oemUpgrade linux-image-6.11.0-1016-gcpUpgrade linux-image-6.14.0-1007-aws-64kUpgrade linux-image-6.11.0-28-generic-64kUpgrade linux-image-6.14.0-1008-gcp-64kUpgrade linux-image-6.11.0-1014-raspiUpgrade linux-image-azureUpgrade linux-image-lowlatency-6.11Upgrade linux-image-lowlatency-64k-6.11Upgrade linux-image-6.11.0-1015-lowlatency-64kUpgrade linux-image-gcp-64kUpgrade linux-image-6.14.0-22-genericUpgrade linux-image-6.11.0-1017-oracleUpgrade linux-image-realtimeUpgrade linux-image-6.14.0-1007-azureUpgrade linux-image-raspiUpgrade linux-image-6.14.0-1004-realtimeUpgrade linux-image-6.11.0-1016-gcp-64kUpgrade linux-image-6.14.0-1007-raspiUpgrade linux-image-oracle-64kUpgrade linux-image-6.11.0-1015-lowlatencyUpgrade linux-image-6.14.0-1007-oracleUpgrade linux-image-6.14.0-1007-awsUpgrade linux-image-generic-64kUpgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-6.14.0-1008-gcpUpgrade linux-image-6.11.0-1017-oracle-64kUpgrade linux-image-azure-6.11Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.11.0-28-genericUpgrade linux-image-azure-fdeUpgrade linux-image-genericUpgrade linux-image-lowlatency-64kUpgrade linux-image-6.11.0-1015-awsUpgrade linux-image-6.14.0-1007-oracle-64kUpgrade linux-image-lowlatencyUpgrade linux-image-6.14.0-22-generic-64kUpgrade linux-image-oracleUpgrade linux-image-aws-64kUpgrade linux-image-gcpUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.11.0-1011-realtimeUpgrade linux-image-virtualUpgrade linux-image-azure-fde-edgeUpgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-oem-24.04bUpgrade linux-image-6.11.0-1018-azure | Jun 26, 2025 | Apr 16, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub