CVE-2026-72238

Received Received - Intake

Linux kernel Early Boot Hang via Invalid UART Baud Rate

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: x86/boot: Validate console=uart8250 baud rate to fix early boot hang When the baud rate is empty, 0, invalid, or overflows to 0 when stored as an int, the system will hang during early boot because of a division by zero in early_serial_init(). Fall back to DEFAULT_BAUD when the resulting baud rate is 0 to prevent an early system hang.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72238

EUVD

EUVD-2026-59137

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability affects the Linux kernel's early boot process. When the console UART8250 baud rate is set to an empty value, zero, invalid, or overflows to zero, the system hangs during early boot due to a division by zero error in the early_serial_init() function. The fix ensures the system falls back to a default baud rate (DEFAULT_BAUD) if the calculated rate is zero, preventing the hang.

Detection Guidance

This vulnerability causes a system hang during early boot due to a division by zero in early_serial_init() when the baud rate is invalid or zero. Detection requires checking kernel boot parameters for console=uart8250 with an empty, zero, or invalid baud rate. Examine bootloader configurations and kernel command lines for such entries.

Impact Analysis

If you are using a Linux system with a UART8250 serial console configured with an invalid or zero baud rate, the system may fail to boot properly, resulting in a complete hang during the early boot phase. This could prevent the system from starting up entirely.

Compliance Impact

This vulnerability causes an early system hang during boot due to a division by zero in the Linux kernel's serial console initialization. It does not directly impact data privacy, security controls, or compliance requirements like GDPR or HIPAA, as it affects system availability rather than data handling or protection mechanisms.

Mitigation Strategies

Update the Linux kernel to a patched version where the issue is resolved. Ensure the console=uart8250 baud rate parameter, if used, is set to a valid non-zero value. Review and correct any bootloader configurations that specify an invalid baud rate.

Hi! I’m here to help you understand CVE-2026-72238. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70