In the Linux kernel, the serial8250_register_8250_port function only copies a device pointer when it is non‑NULL, leaving uart->port.dev as NULL if both the existing slot and the new port have no parent device. The very next call to has_acpi_companion dereferences dev->fwnode without a NULL guard, causing a null pointer dereference that crashes the kernel and results in a denial of service. This flaw manifests during serial port registration on machines that use legacy or non‑ACPI driver configurations.

The vulnerability is confined to the Linux kernel’s serial8250 driver. Any distribution that includes an unpatched instance of this driver—i.e., any kernel version before the patch that eliminates the unguarded dereference—may be affected. Vendors that ship kernels with the legacy serial port configuration enabled, particularly those that allow serial ports to be registered without a parent device, are at risk.

Exploitation requires the ability to register a serial port via a driver or ACPI interface, a privilege that is normally local or requires a kernel module. An attacker who obtains such ability can trigger the NULL dereference and crash the kernel, achieving a complete denial of service. The CVSS score of 5.5 indicates moderate severity, and the EPSS score is <1%, indicating a very low probability of exploitation. CISA does not list this vulnerability in KEV, which suggests no confirmed active exploitation. Nevertheless, the potential impact of a kernel crash is substantial, and the exploitability is enabled by an engineering oversight rather than a complex attack vector.