CVE-2026-23115: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-23115 is a race condition vulnerability in the Linux kernel's serial device driver initialization, classified as CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization). It affects Linux kernel versions 6.15 through 6.18.7 and release candidates 6.19-rc1 through 6.19-rc6. The flaw was introduced by commit bfc467db60b7 which incorrectly removed a tty_port_link_device() call, allowing user-space to open a console device before the TTY port is properly linked to the driver. It carries a CVSS v3.1 base score of 4.7 (Medium) (Feedly).

The root cause is an improper sequencing in the serial_core_add_one_port() function (CWE-362). Commit bfc467db60b7 removed the tty_port_link_device() call, which had been explicitly added by commit fb2b90014d78 to ensure the TTY port is linked to the driver before uart_configure_port() is called. Without this ordering guarantee, a race window exists during fast boot sequences where user-space (e.g., systemd) can call open() on the console device, triggering tty_init_dev() before tty->port is set, resulting in a kernel warning: tty_init_dev: ttyMSM driver does not set tty->port. This would crash the kernel. The condition is most reliably reproduced on Qualcomm SoCs with minimal device initialization and very fast boot times (Feedly).

Successful triggering of this race condition causes kernel instability and a potential denial of service (DoS) via kernel crash. The impact is limited to availability (no confidentiality or integrity impact), and exploitation requires local access with low privileges. Systems most at risk are those with fast boot paths and serial consoles, such as embedded or mobile platforms using Qualcomm SoCs (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.018%, reflecting very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and is highly timing-dependent, making it difficult to reliably trigger outside of specific hardware configurations (Feedly).

• Logs: Kernel warning message during boot: tty_init_dev: ttyMSM driver does not set tty->port. This would crash the kernel. Fix the driver! appearing in dmesg or /var/log/kern.log.
• Logs: Associated kernel stack trace in system logs referencing tty_init_dev.part.0 at drivers/tty/tty_io.c:1414, triggered by PID 1 (e.g., systemd).
• Logs: Duplicate console registration messages such as printk: legacy console [ttyMSM0] enabled appearing twice, followed by bootconsole disable messages, preceding the warning.

The fix restores the tty_port_link_device() call that was incorrectly removed, and is available in kernel commits 2501c493 and 32f37e57 on the stable tree (Kernel Commits). Affected users should update to Linux kernel 6.18.8 or later for the 6.18 series; the fix will also be included in the 6.19 stable release. As a temporary workaround where patching is not immediately possible, restrict access to serial console devices and monitor kernel logs during boot for the associated warning. Prioritize patching on systems with fast boot times or Qualcomm SoC hardware, as these are most susceptible to triggering the race condition (Feedly).