CVE-2026-97480

Red Hat Product Security rates the impact of this flaw as Low. A NULL pointer dereference flaw was found in the Linux kernel's 8250 serial driver. When serial8250_register_8250_port() registers a serial port that has no associated parent device (legacy non-OF/non-ACPI registration), uart->port.dev can remain NULL, and the immediately following has_acpi_companion() check dereferences that pointer unconditionally, causing a kernel oops or panic. A local attacker with privileged access (for example, the ability to load the serial driver or control device/platform registration) could trigger this path to crash the system, resulting in a denial of service; there is no impact on confidentiality or integrity. Red Hat Enterprise Linux 9 (including the kernel-rt variant), Red Hat Enterprise Linux 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases based on RHEL CoreOS 9 are affected. Because exploitation requires privileged local access and the consequence is limited to availability, the fix is currently deferred for the affected streams; the residual risk is that a privileged local user can panic the kernel on an affected system. Red Hat Enterprise Linux 6, 7, and 8, and OpenShift Container Platform 4.12 (RHEL CoreOS 8), are not affected because the vulnerable code is not present in those products. Although the Red Hat CVSS 3.1 base score is 5.5 (Moderate), Red Hat's overall impact rating is Low because the flaw is not remotely exploitable, requires privileged local access, and results only in denial of service.