CVE-2026-63876 - Vulnerability Details

- serial: zs: Convert to use a platform device

Description

In the Linux kernel, the following vulnerability has been resolved:

serial: zs: Convert to use a platform device

Prevent a crash from happening as the first serial port is initialised:

Console: switching to mono frame buffer device 160x64
fb0: PMAG-AA frame buffer device at tc0
DECstation Z85C30 serial driver version 0.10
CPU 0 Unable to handle kernel paging request at virtual address 0000002c, epc == 803ab00c, ra == 803aafe0
Oops[#1]:
CPU: 0 PID: 1 Comm: swapper Not tainted 6.4.0-rc3-00031-g84a9582fd203-dirty #57
$ 0 : 00000000 10012c00 803aaeb0 00000000
$ 4 : 80e12f60 80e12f50 80e12f58 81000030
$ 8 : 00000000 805ff37c 00000000 33433538
$12 : 65732030 00000006 80c2915d 6c616972
$16 : 80e12f00 807b7630 00000000 00000000
$20 : 00000004 00000348 000001a0 807623b8
$24 : 00000018 00000000
$28 : 80c24000 80c25d60 8078b148 803aafe0
Hi : 00000000
Lo : 00000000
epc : 803ab00c serial_base_ctrl_add+0x78/0xf4
ra : 803aafe0 serial_base_ctrl_add+0x4c/0xf4
Status: 10012c03 KERNEL EXL IE
Cause : 00000008 (ExcCode 02)
BadVA : 0000002c
PrId : 00000440 (R4400SC)
Modules linked in:
Process swapper (pid: 1, threadinfo=(ptrval), task=(ptrval), tls=00000000)
Stack : 80760000 00000cc0 00400044 00400040 803aa02c 80d61ab8 00000000 807b7630
80760000 807623b8 807b7628 803aa644 80386998 00000000 80e17780 80220f68
80e17780 80d61ab8 80c17d80 80e17780 80e17780 8063c798 80e17780 80383fa0
00000010 80e17780 00000000 80386998 807a0000 00000000 00400040 8038f848
807623b8 80d61ab8 00000004 80e17780 00000000 803a68e4 80c25e2c 803bb884
...
Call Trace:
[<803ab00c>] serial_base_ctrl_add+0x78/0xf4
[<803aa644>] serial_core_register_port+0x174/0x69c
[<8077e9ac>] zs_init+0xc8/0xfc
[<800404d4>] do_one_initcall+0x40/0x2ac
[<8076cecc>] kernel_init_freeable+0x1e4/0x270
[<80605bec>] kernel_init+0x20/0x108
[<800431e8>] ret_from_kernel_thread+0x14/0x1c

Code: 2442aeb0 ae120024 ae0200d0 <8c67002c> 50e00001 8c670000 3c06806e 3c05806e afb30010

---[ end trace 0000000000000000 ]---

(report at the offending commit) -- where a pointer is dereferenced that
has been derived from a null pointer to the port's parent device.

Since no device is available with legacy probing and it's not anymore a
preferable way to discover devices anyway, switch the driver to using a
platform device and use it as the port's parent device. Update resource
handling accordingly and only request the actual span of addresses used
within the slot, which will have had its resource already requested by
generic platform device code.

Use platform_driver_probe() not just because SCC devices are fixed with
solder on board and not straightforward to remove, but foremost because
the associated TTY's major device number is the same as used by the dz
driver and the first driver to claim it will prevent the other one from
using it. Either one DZ device or some SCC devices will be present in a
given system but never both at a time, and therefore we want the major
device number to be claimed by the first driver to actually successfully
bind to its device and platform_driver_probe() is a way to fulfil that.

An unfortunate consequence of the switch to a platform device is we now
hand the console over from the bootconsole much later in the bootstrap.
The firmware console handler appears good enough though to work so late
and in particular with interrupts enabled.

Since there is one way only remaining to reach zs_reset() now, remove
the port initialisation marker as no longer needed and go through the
channel reset unconditionally.

Published: 2026-07-19

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a null pointer dereference in the Zilog ZS serial driver that occurs during the first serial port initialization. It triggers an unhandled kernel paging request, causing a kernel crash and preventing the system from completing its boot sequence. The flaw is a denial‑of‑service weakness that compromises system availability, as any early boot procedure involving this driver will fail.

Affected Systems

The issue affects the Linux kernel’s serial driver for Zilog ZS (zs) devices, present in the generic Linux kernel source tree. Any system running a kernel containing the original zs driver before the platform‑device refactor is vulnerable. No specific vendor or version list is provided beyond the generic “Linux kernel” label; the problem was demonstrated in a 6.4.0‑rc3 build, but the fix applies to all affected revisions.

Risk and Exploitability

The flaw is a null pointer dereference that occurs during the first serial port initialization and results in a kernel panic, disrupting normal boot. Based on the description, it is inferred that the attack surface is limited to the firmware and early boot environment, as the crash happens before the system reaches user space. The EPSS score is below 1 % and the flaw is not listed in the CISA KEV catalog, indicating a very low likelihood of exploitation. The CVSS score of 5.5 classifies it as a medium‑severity flaw, but the crash still disrupts system availability during startup.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`84a9582fd203063cd4d301204971ff2cd8327f1a`	affected	< bb2040484f90f91b717060e1a66026cc4287bcf0
`84a9582fd203063cd4d301204971ff2cd8327f1a`	affected	< 6a83d5e24a84e746425cd93539130e5f7381ef47
`84a9582fd203063cd4d301204971ff2cd8327f1a`	affected	< 237dc8c08de3cb293b6607aaee8b13b3a671e267
`84a9582fd203063cd4d301204971ff2cd8327f1a`	affected	< 4dc9f1517503c883d5ce25b7ab29d177d05edc6a
`84a9582fd203063cd4d301204971ff2cd8327f1a`	affected	< 7cac59d08a73cb866ec51a483a6f3fe0f531947c

Linux

affected

Version	Status	Constraints
`6.5`	affected	—
`0`	unaffected	< 6.5
`6.6.143`	unaffected	≤ 6.6.*
`6.12.93`	unaffected	≤ 6.12.*
`6.18.35`	unaffected	≤ 6.18.*
`7.0.12`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[84a9582fd203063cd4d301204971ff2cd8327f1a,bb2040484f90f91b717060e1a66026cc4287bcf0)`	affected	code_commit	—
`[84a9582fd203063cd4d301204971ff2cd8327f1a,6a83d5e24a84e746425cd93539130e5f7381ef47)`	affected	code_commit	—
`[84a9582fd203063cd4d301204971ff2cd8327f1a,237dc8c08de3cb293b6607aaee8b13b3a671e267)`	affected	code_commit	—
`[84a9582fd203063cd4d301204971ff2cd8327f1a,4dc9f1517503c883d5ce25b7ab29d177d05edc6a)`	affected	code_commit	—
`[84a9582fd203063cd4d301204971ff2cd8327f1a,7cac59d08a73cb866ec51a483a6f3fe0f531947c)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.5`	affected	semver	—
`[0,6.5)`	unaffected	semver	—
`[6.6.143,7.0.0)`	unaffected	semver	—
`[6.12.93,6.13.0)`	unaffected	semver	—
`[6.18.35,6.19.0)`	unaffected	semver	—
`[7.0.12,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest kernel that incorporates the zs driver refactor, as referenced in the commit logs.
If you must remain on a kernel that still uses the legacy zs driver, disable that driver by blacklisting it or removing it from the initramfs, or compile it as a separate module that does not load at boot.
As a temporary workaround, remove or comment out any console configurations that reference the zs serial driver in the bootloader or firmware scripts to avoid early port initialization.

Generated by OpenCVE AI on August 4, 2026 at 06:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00209.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/237dc8c08de3cb293b6607aaee8b13b3a671e267
https://git.kernel.org/stable/c/4dc9f1517503c883d5ce25b7ab29d177d05edc6a
https://git.kernel.org/stable/c/6a83d5e24a84e746425cd93539130e5f7381ef47
https://git.kernel.org/stable/c/7cac59d08a73cb866ec51a483a6f3fe0f531947c
https://git.kernel.org/stable/c/bb2040484f90f91b717060e1a66026cc4287bcf0
https://lore.kernel.org/linux-cve-announce/2026071938-CVE-2026-63876-877f@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-63876
https://www.cve.org/CVERecord?id=CVE-2026-63876

History

Wed, 22 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://lore.kernel.org/linux-cve-announce/2026071938-CVE-2026-63876-877f@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-63876 https://www.cve.org/CVERecord?id=CVE-2026-63876
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Sun, 19 Jul 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: serial: zs: Convert to use a platform device Prevent a crash from happening as the first serial port is initialised: Console: switching to mono frame buffer device 160x64 fb0: PMAG-AA frame buffer device at tc0 DECstation Z85C30 serial driver version 0.10 CPU 0 Unable to handle kernel paging request at virtual address 0000002c, epc == 803ab00c, ra == 803aafe0 Oops[#1]: CPU: 0 PID: 1 Comm: swapper Not tainted 6.4.0-rc3-00031-g84a9582fd203-dirty #57 $ 0 : 00000000 10012c00 803aaeb0 00000000 $ 4 : 80e12f60 80e12f50 80e12f58 81000030 $ 8 : 00000000 805ff37c 00000000 33433538 $12 : 65732030 00000006 80c2915d 6c616972 $16 : 80e12f00 807b7630 00000000 00000000 $20 : 00000004 00000348 000001a0 807623b8 $24 : 00000018 00000000 $28 : 80c24000 80c25d60 8078b148 803aafe0 Hi : 00000000 Lo : 00000000 epc : 803ab00c serial_base_ctrl_add+0x78/0xf4 ra : 803aafe0 serial_base_ctrl_add+0x4c/0xf4 Status: 10012c03 KERNEL EXL IE Cause : 00000008 (ExcCode 02) BadVA : 0000002c PrId : 00000440 (R4400SC) Modules linked in: Process swapper (pid: 1, threadinfo=(ptrval), task=(ptrval), tls=00000000) Stack : 80760000 00000cc0 00400044 00400040 803aa02c 80d61ab8 00000000 807b7630 80760000 807623b8 807b7628 803aa644 80386998 00000000 80e17780 80220f68 80e17780 80d61ab8 80c17d80 80e17780 80e17780 8063c798 80e17780 80383fa0 00000010 80e17780 00000000 80386998 807a0000 00000000 00400040 8038f848 807623b8 80d61ab8 00000004 80e17780 00000000 803a68e4 80c25e2c 803bb884 ... Call Trace: [<803ab00c>] serial_base_ctrl_add+0x78/0xf4 [<803aa644>] serial_core_register_port+0x174/0x69c [<8077e9ac>] zs_init+0xc8/0xfc [<800404d4>] do_one_initcall+0x40/0x2ac [<8076cecc>] kernel_init_freeable+0x1e4/0x270 [<80605bec>] kernel_init+0x20/0x108 [<800431e8>] ret_from_kernel_thread+0x14/0x1c Code: 2442aeb0 ae120024 ae0200d0 <8c67002c> 50e00001 8c670000 3c06806e 3c05806e afb30010 ---[ end trace 0000000000000000 ]--- (report at the offending commit) -- where a pointer is dereferenced that has been derived from a null pointer to the port's parent device. Since no device is available with legacy probing and it's not anymore a preferable way to discover devices anyway, switch the driver to using a platform device and use it as the port's parent device. Update resource handling accordingly and only request the actual span of addresses used within the slot, which will have had its resource already requested by generic platform device code. Use platform_driver_probe() not just because SCC devices are fixed with solder on board and not straightforward to remove, but foremost because the associated TTY's major device number is the same as used by the dz driver and the first driver to claim it will prevent the other one from using it. Either one DZ device or some SCC devices will be present in a given system but never both at a time, and therefore we want the major device number to be claimed by the first driver to actually successfully bind to its device and platform_driver_probe() is a way to fulfil that. An unfortunate consequence of the switch to a platform device is we now hand the console over from the bootconsole much later in the bootstrap. The firmware console handler appears good enough though to work so late and in particular with interrupts enabled. Since there is one way only remaining to reach zs_reset() now, remove the port initialisation marker as no longer needed and go through the channel reset unconditionally.
Title		serial: zs: Convert to use a platform device
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/237dc8c08de3cb293b6607aaee8b13b3a671e267 https://git.kernel.org/stable/c/4dc9f1517503c883d5ce25b7ab29d177d05edc6a https://git.kernel.org/stable/c/6a83d5e24a84e746425cd93539130e5f7381ef47 https://git.kernel.org/stable/c/7cac59d08a73cb866ec51a483a6f3fe0f531947c https://git.kernel.org/stable/c/bb2040484f90f91b717060e1a66026cc4287bcf0

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T14:54:49.549Z

Updated: 2026-07-19T14:54:49.549Z

Reserved: 2026-07-19T07:54:57.018Z

Link: CVE-2026-63876

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Low

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-63876 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-04T07:00:05Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object