---
id: CVE-2025-38262
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tty: serial: uartlite: register uart driver in init

  When two instances of uart devices are probing, a concurrency race can
  occur
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tty: serial: uartlite: register uart driver in init

  When two instances of uart devices are probing, a concurrency race can
  occur. If one thread calls uart_register_dri…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-476
  - CWE-824
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 2.6.20, < 5.4.296'
  - 'linux_kernel >= 5.5, < 5.15.187'
  - 'linux_kernel >= 5.16, < 6.1.143'
  - 'linux_kernel >= 6.2, < 6.6.96'
  - 'linux_kernel >= 6.7, < 6.12.36'
  - 'linux_kernel >= 6.13, < 6.15.5'
  - debian_linux = 11.0
patched:
  - linux_kernel 6.15.5
published: '2025-07-09'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:18:37.363'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-38262'
references:
  - url: 'https://git.kernel.org/stable/c/5015eed450005bab6e5cb6810f7a62eab0434fc4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/685d29f2c5057b32c7b1b46f2a7d303b926c8f72'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6bd697b5fc39fd24e2aa418c7b7d14469f550a93'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6db06aaea07bb7c8e33a425cf7b98bf29ee6056e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8e958d10dd0ce5ae674cce460db5c9ca3f25243b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9c905fdbba68a6d73d39a6b7de9b9f0d6c46df87'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f5e4229d94792b40e750f30c92bcf7a3107c72ef'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38262.json
  - url: 'https://access.redhat.com/security/cve/CVE-2025-38262'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2378987'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2025-38262'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-38262'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2025070936-CVE-2025-38262-419f@gregkh/T
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - cve.org
  - score-dispute
epss: 0.00187
epssPercentile: 0.08199
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:49:09.978264Z'
scores:
  nvd: 7.8
  vendor: 4.1
  cna: 7.8
ingestedAt: '2026-10-15T22:48:25.501Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

tty: serial: uartlite: register uart driver in init

When two instances of uart devices are probing, a concurrency race can
occur. If one thread calls uart_register_driver function, which first
allocates and assigns memory to 'uart_state' member of uart_driver
structure, the other instance can bypass uart driver registration and
call ulite_assign. This calls uart_add_one_port, which expects the uart
driver to be fully initialized. This leads to a kernel panic due to a
null pointer dereference:

[    8.143581] BUG: kernel NULL pointer dereference, address: 00000000000002b8
[    8.156982] #PF: supervisor write access in kernel mode
[    8.156984] #PF: error_code(0x0002) - not-present page
[    8.156986] PGD 0 P4D 0
...
[    8.180668] RIP: 0010:mutex_lock+0x19/0x30
[    8.188624] Call Trace:
[    8.188629]  ? __die_body.cold+0x1a/0x1f
[    8.195260]  ? page_fault_oops+0x15c/0x290
[    8.209183]  ? __irq_resolve_mapping+0x47/0x80
[    8.209187]  ? exc_page_fault+0x64/0x140
[    8.209190]  ? asm_exc_page_fault+0x22/0x30
[    8.209196]  ? mutex_lock+0x19/0x30
[    8.223116]  uart_add_one_port+0x60/0x440
[    8.223122]  ? proc_tty_register_driver+0x43/0x50
[    8.223126]  ? tty_register_driver+0x1ca/0x1e0
[    8.246250]  ulite_probe+0x357/0x4b0 [uartlite]

To prevent it, move uart driver registration in to init function. This
will ensure that uart_driver is always registered when probe function
is called.

## Affected

- `linux_kernel >= 2.6.20, < 5.4.296`
- `linux_kernel >= 5.5, < 5.15.187`
- `linux_kernel >= 5.16, < 6.1.143`
- `linux_kernel >= 6.2, < 6.6.96`
- `linux_kernel >= 6.7, < 6.12.36`
- `linux_kernel >= 6.13, < 6.15.5`
- `debian_linux = 11.0`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.15.5`

## Vendor advisories

- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38262.json)