CVE-2026-98883 - Vulnerability Details

Description

In the Linux kernel, the following vulnerability has been resolved:

serial: 8250_port: recognize UPIO_AU

My MIPS Alchemy systems generate the following warning during
probe of the 8250 driver:

WARNING: drivers/tty/serial/8250/8250_port.c:462 at set_io_from_upio+0xfc/0x124, CPU#0: swapper/0/1
Unsupported UART type 4
[...]
[<80521d40>] set_io_from_upio+0xfc/0x124
[<80521dfc>] serial8250_set_defaults+0x94/0xe0
[<80520fb4>] serial8250_register_8250_port+0x288/0x51c
[<805214ec>] serial8250_probe+0x160/0x1e8
[<8053b5f0>] platform_probe+0x64/0x90

The least invasive fix is to recognize UPIO_AU (type 4) in set_io_from_upio()
and do nothing, since all parameters have already been set up in
8250_rt288x.c::au_platform_setup().

Run-tested on Alchemy Au1300 platform.

Published: 2026-10-23

Score: 4.1 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The kernel's 8250 serial driver fails to recognize the UPIO_AU UART type (type 4), which leads to a probe warning and an uninitialized port, causing loss of serial interface functionality. This behavior reflects inappropriate handling of memory after free (CWE-617). No indication of code execution or data exposure is present beyond the loss of serial communication.

Affected Systems

This issue affects the Linux kernel running on MIPS‑based Alchemy systems, particularly the Au1300 platform. The vendor identifiers are generic Linux, and the affected product is the Linux kernel as a whole; no specific kernel release range is provided in the data.

Risk and Exploitability

The CVSS score is 4.1, and the EPSS score is < 1%. The vulnerability is not listed in CISA’s KEV catalogue. Because the defect is a kernel‑level local fault with no documented exploitation method, the risk level is low. An attacker would need kernel‑level access to effect any impact, and no public exploits are known.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`7c7e6c8924e7bf98db4e5b2edb202842003c00c2`	affected	< 9f67997353caa29c6a080789a1fb6e01fb50c118
`7c7e6c8924e7bf98db4e5b2edb202842003c00c2`	affected	< 49fa670efdfdd27e29145cbd2beef065c08717ef

Linux

affected

Version	Status	Constraints
`6.13`	affected	—
`0`	unaffected	< 6.13
`6.18.53`	unaffected	≤ 6.18.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

100%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,9f67997353caa29c6a080789a1fb6e01fb50c118)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,49fa670efdfdd27e29145cbd2beef065c08717ef)`	affected	code_commit	—
`[0,6.18.53)`	affected	semver	—

Linux

100%

Version	Status	Scheme	Platform
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,9f67997353caa29c6a080789a1fb6e01fb50c118)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,49fa670efdfdd27e29145cbd2beef065c08717ef)`	affected	code_commit	—
`[0,6.18.53)`	affected	semver	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the patch recognising UPIO_AU.
Manually apply the patch from the provided kernel repository commits if an update is not immediately possible.
Disable the offending UART device in the device tree or configure the driver not to probe it to avoid the warning.
Monitor system logs for the ‘Unsupported UART type 4’ warning and treat repeated occurrences as an indicator of a deeper issue.

Generated by OpenCVE AI on October 27, 2026 at 10:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00161.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98883.mbox
https://git.kernel.org/stable/c/49fa670efdfdd27e29145cbd2beef065c08717ef
https://git.kernel.org/stable/c/9f67997353caa29c6a080789a1fb6e01fb50c118
https://nvd.nist.gov/vuln/detail/CVE-2026-98883
https://www.cve.org/CVERecord?id=CVE-2026-98883

History

Tue, 27 Oct 2026 09:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-20

Tue, 27 Oct 2026 04:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-617
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98883.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98883 https://www.cve.org/CVERecord?id=CVE-2026-98883
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 23 Oct 2026 18:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-20

Fri, 23 Oct 2026 14:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Fri, 23 Oct 2026 12:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: serial: 8250_port: recognize UPIO_AU My MIPS Alchemy systems generate the following warning during probe of the 8250 driver: WARNING: drivers/tty/serial/8250/8250_port.c:462 at set_io_from_upio+0xfc/0x124, CPU#0: swapper/0/1 Unsupported UART type 4 [...] [<80521d40>] set_io_from_upio+0xfc/0x124 [<80521dfc>] serial8250_set_defaults+0x94/0xe0 [<80520fb4>] serial8250_register_8250_port+0x288/0x51c [<805214ec>] serial8250_probe+0x160/0x1e8 [<8053b5f0>] platform_probe+0x64/0x90 The least invasive fix is to recognize UPIO_AU (type 4) in set_io_from_upio() and do nothing, since all parameters have already been set up in 8250_rt288x.c::au_platform_setup(). Run-tested on Alchemy Au1300 platform.
Title		serial: 8250_port: recognize UPIO_AU
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/49fa670efdfdd27e29145cbd2beef065c08717ef https://git.kernel.org/stable/c/9f67997353caa29c6a080789a1fb6e01fb50c118

Subscriptions

Linux Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-23T11:37:38.372Z

Updated: 2026-10-26T06:56:06.942Z

Reserved: 2026-09-25T10:25:14.378Z

Link: CVE-2026-98883

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-23T12:18:21.970

Modified: 2026-10-26T07:17:13.227

Link: CVE-2026-98883

Redhat

Severity : Moderate

Publid Date: 2026-10-23T00:00:00Z

Links: CVE-2026-98883 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-27T10:45:06Z

Weaknesses

CWE-617
Reachable Assertion

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object