CVE-2026-68434

Received Received - Intake

NULL Pointer Dereference in Linux Kernel 8250_mid Driver

Publication date: 2026-08-12

Last updated on: 2026-08-23

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms Commit b1b4efea05a5 ("serial: 8250_mid: Disable DMA for selected platforms") replaced the dnv_board setup and exit callbacks with PTR_IF(false, ...), which evaluates to NULL. However, the three call sites in mid8250_probe() and mid8250_remove() unconditionally dereference these function pointers without NULL checks, causing a NULL pointer dereference (kernel oops) on any Denverton (DNV), Ice Lake Xeon D (ICX-D/CDF), or Snowridge (SNR) platform. Fix this by adding the missing NULL checks before calling the setup and exit callbacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-23

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-31

NVD

CVE-2026-68434

EUVD

EUVD-2026-57042

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a NULL pointer dereference in the Linux kernel's serial driver for 8250_mid. It affects Denverton (DNV), Ice Lake Xeon D (ICX-D/CDF), and Snowridge (SNR) platforms. The issue occurs because function pointers for setup and exit callbacks were replaced with NULL values but are still called without checks, causing a kernel oops.

Detection Guidance

This vulnerability causes a kernel oops (NULL pointer dereference) on Denverton (DNV), Ice Lake Xeon D (ICX-D/CDF), or Snowridge (SNR) platforms. Check kernel logs for oops messages using 'dmesg | grep -i oops' or 'journalctl -k | grep -i oops'.

Impact Analysis

This vulnerability can cause a kernel crash (oops) on affected platforms, leading to system instability or unavailability. Users may experience sudden reboots, freezes, or loss of functionality in serial port operations.

Compliance Impact

This vulnerability causes a kernel oops due to a NULL pointer dereference in the Linux kernel's serial driver for specific platforms. It does not directly impact compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy rather than kernel stability.

Mitigation Strategies

Apply the kernel patch that adds NULL checks before calling setup and exit callbacks. Update to a fixed Linux kernel version where this issue is resolved.

Hi! I’m here to help you understand CVE-2026-68434. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70