{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-53176","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-09-15T13:59:19.064Z","datePublished":"2025-09-15T14:04:16.360Z","dateUpdated":"2026-08-05T09:12:55.297Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T09:12:55.297Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nserial: 8250: Reinit port->pm on port specific driver unbind\n\nWhen we unbind a serial port hardware specific 8250 driver, the generic\nserial8250 driver takes over the port. After that we see an oops about 10\nseconds later. This can produce the following at least on some TI SoCs:\n\nUnhandled fault: imprecise external abort (0x1406)\nInternal error: : 1406 [#1] SMP ARM\n\nTurns out that we may still have the serial port hardware specific driver\nport->pm in use, and serial8250_pm() tries to call it after the port\nspecific driver is gone:\n\nserial8250_pm [8250_base] from uart_change_pm+0x54/0x8c [serial_base]\nuart_change_pm [serial_base] from uart_hangup+0x154/0x198 [serial_base]\nuart_hangup [serial_base] from __tty_hangup.part.0+0x328/0x37c\n__tty_hangup.part.0 from disassociate_ctty+0x154/0x20c\ndisassociate_ctty from do_exit+0x744/0xaac\ndo_exit from do_group_exit+0x40/0x8c\ndo_group_exit from __wake_up_parent+0x0/0x1c\n\nLet's fix the issue by calling serial8250_set_defaults() in\nserial8250_unregister_port(). This will set the port back to using\nthe serial8250 default functions, and sets the port->pm to point to\nserial8250_pm."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached via local serial TTY hangup after a hardware-specific 8250 driver unbind/unregister hands the port back to generic serial8250; exploitation uses local device/sysfs/module operations, not network or adjacent-network access.\nAC:L - Once the port-specific driver is unbound, opening the re-registered TTY and triggering hangup (process exit/disassociate_ctty) reliably invokes the stale port->pm callback with no race or uncontrolled environmental condition.\nPR:L - Triggering the stale callback only requires opening a serial TTY and causing hangup, which unprivileged users in typical dialout/serial groups can do; establishing unbind can also occur via hotplug paths without real root in the init namespace.\nUI:N - The attacker can perform the unbind (or rely on device removal) and then open/hang up the TTY themselves; no separate victim interaction is required.\nS:U - Impact remains within the kernel's authority on the local host; this is not a VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:H - Calling a stale port->pm into an unloaded driver is a function-pointer use-after-free that can be leveraged for arbitrary kernel memory disclosure under the higher-severity UAF guidance.\nI:H - The same stale callback UAF into freed module text can be abused for control-flow hijacking and arbitrary write/code execution primitives, not merely a clean crash.\nA:H - The demonstrated result is a kernel oops/abort (imprecise external abort / paging request) via uart_hangup → uart_change_pm → serial8250_pm, which is a full availability impact."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/tty/serial/8250/8250_core.c"],"versions":[{"version":"c161afe9759ddcc174d08e7c4f683d08ac9ba86f","lessThan":"490bf37eaabb0a857ed1ae8e75d8854e41662f1c","status":"affected","versionType":"git"},{"version":"c161afe9759ddcc174d08e7c4f683d08ac9ba86f","lessThan":"c9e080c3005fd183c56ff8f4d75edb5da0765d2c","status":"affected","versionType":"git"},{"version":"c161afe9759ddcc174d08e7c4f683d08ac9ba86f","lessThan":"d5cd2928d31042a7c0a01464f9a8d95be736421d","status":"affected","versionType":"git"},{"version":"c161afe9759ddcc174d08e7c4f683d08ac9ba86f","lessThan":"2c86a1305c1406f45ea780d06953c484ea1d9e6e","status":"affected","versionType":"git"},{"version":"c161afe9759ddcc174d08e7c4f683d08ac9ba86f","lessThan":"1ba5594739d858e524ff0f398ee1ebfe0a8b9d41","status":"affected","versionType":"git"},{"version":"c161afe9759ddcc174d08e7c4f683d08ac9ba86f","lessThan":"af4d6dbb1a92ea424ad1ba1d0c88c7fa2345d872","status":"affected","versionType":"git"},{"version":"c161afe9759ddcc174d08e7c4f683d08ac9ba86f","lessThan":"8e596aed5f2f98cf3e6e98d6fe1d689f4a319308","status":"affected","versionType":"git"},{"version":"c161afe9759ddcc174d08e7c4f683d08ac9ba86f","lessThan":"04e82793f068d2f0ffe62fcea03d007a8cdc16a7","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/tty/serial/8250/8250_core.c"],"versions":[{"version":"2.6.37","status":"affected"},{"version":"0","lessThan":"2.6.37","status":"unaffected","versionType":"semver"},{"version":"4.14.316","lessThanOrEqual":"4.14.*","status":"unaffected","versionType":"semver"},{"version":"4.19.284","lessThanOrEqual":"4.19.*","status":"unaffected","versionType":"semver"},{"version":"5.4.244","lessThanOrEqual":"5.4.*","status":"unaffected","versionType":"semver"},{"version":"5.10.181","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.113","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.30","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.3.4","lessThanOrEqual":"6.3.*","status":"unaffected","versionType":"semver"},{"version":"6.4","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.37","versionEndExcluding":"4.14.316"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.37","versionEndExcluding":"4.19.284"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.37","versionEndExcluding":"5.4.244"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.37","versionEndExcluding":"5.10.181"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.37","versionEndExcluding":"5.15.113"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.37","versionEndExcluding":"6.1.30"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.37","versionEndExcluding":"6.3.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.37","versionEndExcluding":"6.4"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/490bf37eaabb0a857ed1ae8e75d8854e41662f1c"},{"url":"https://git.kernel.org/stable/c/c9e080c3005fd183c56ff8f4d75edb5da0765d2c"},{"url":"https://git.kernel.org/stable/c/d5cd2928d31042a7c0a01464f9a8d95be736421d"},{"url":"https://git.kernel.org/stable/c/2c86a1305c1406f45ea780d06953c484ea1d9e6e"},{"url":"https://git.kernel.org/stable/c/1ba5594739d858e524ff0f398ee1ebfe0a8b9d41"},{"url":"https://git.kernel.org/stable/c/af4d6dbb1a92ea424ad1ba1d0c88c7fa2345d872"},{"url":"https://git.kernel.org/stable/c/8e596aed5f2f98cf3e6e98d6fe1d689f4a319308"},{"url":"https://git.kernel.org/stable/c/04e82793f068d2f0ffe62fcea03d007a8cdc16a7"}],"title":"serial: 8250: Reinit port->pm on port specific driver unbind","x_generator":{"engine":"bippy-1.2.0"}}}}