linux-cve-announce - CVE-2023-54220: serial: 8250: Fix oops for port->pm on uart_change

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025123027-CVE-2023-54220-2951@gregkh>
Date: Tue, 30 Dec 2025 13:13:50 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2023-54220: serial: 8250: Fix oops for port->pm on uart_change_pm()

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

serial: 8250: Fix oops for port->pm on uart_change_pm()

Unloading a hardware specific 8250 driver can produce error "Unable to
handle kernel paging request at virtual address" about ten seconds after
unloading the driver. This happens on uart_hangup() calling
uart_change_pm().

Turns out commit 04e82793f068 ("serial: 8250: Reinit port->pm on port
specific driver unbind") was only a partial fix. If the hardware specific
driver has initialized port->pm function, we need to clear port->pm too.
Just reinitializing port->ops does not do this. Otherwise serial8250_pm()
will call port->pm() instead of serial8250_do_pm().

The Linux kernel CVE team has assigned CVE-2023-54220 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.14.316 with commit 490bf37eaabb0a857ed1ae8e75d8854e41662f1c and fixed in 4.14.324 with commit 66f3e55960698c874b0598277913b478ecd29573
	Issue introduced in 4.19.284 with commit c9e080c3005fd183c56ff8f4d75edb5da0765d2c and fixed in 4.19.293 with commit 720a297b334e85d34099e83d1f375b92c3efedd6
	Issue introduced in 5.4.244 with commit d5cd2928d31042a7c0a01464f9a8d95be736421d and fixed in 5.4.255 with commit b653289ca6460a6552c8590b75dfa84a0140a46b
	Issue introduced in 5.10.181 with commit 2c86a1305c1406f45ea780d06953c484ea1d9e6e and fixed in 5.10.192 with commit bd70d0b28010d560a8be96b44fea86fe2ba016ae
	Issue introduced in 5.15.113 with commit 1ba5594739d858e524ff0f398ee1ebfe0a8b9d41 and fixed in 5.15.128 with commit 18e27df4f2b4e257c317ba8076f31a888f6cc64b
	Issue introduced in 6.1.30 with commit af4d6dbb1a92ea424ad1ba1d0c88c7fa2345d872 and fixed in 6.1.47 with commit 0c05493341d6f2097f75f0a5dbb7b53a9e8c5f6c
	Issue introduced in 6.4 with commit 04e82793f068d2f0ffe62fcea03d007a8cdc16a7 and fixed in 6.4.12 with commit 375806616f8c772c33d40e112530887b37c1a816
	Issue introduced in 6.4 with commit 04e82793f068d2f0ffe62fcea03d007a8cdc16a7 and fixed in 6.5 with commit dfe2aeb226fd5e19b0ee795f4f6ed8bc494c1534
	Issue introduced in 6.3.4 with commit 8e596aed5f2f98cf3e6e98d6fe1d689f4a319308

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-54220
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/tty/serial/8250/8250_port.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/66f3e55960698c874b0598277913b478ecd29573
	https://git.kernel.org/stable/c/720a297b334e85d34099e83d1f375b92c3efedd6
	https://git.kernel.org/stable/c/b653289ca6460a6552c8590b75dfa84a0140a46b
	https://git.kernel.org/stable/c/bd70d0b28010d560a8be96b44fea86fe2ba016ae
	https://git.kernel.org/stable/c/18e27df4f2b4e257c317ba8076f31a888f6cc64b
	https://git.kernel.org/stable/c/0c05493341d6f2097f75f0a5dbb7b53a9e8c5f6c
	https://git.kernel.org/stable/c/375806616f8c772c33d40e112530887b37c1a816
	https://git.kernel.org/stable/c/dfe2aeb226fd5e19b0ee795f4f6ed8bc494c1534