{"api_version":"1","generated_at":"2026-07-23T15:36:39+00:00","cve":"CVE-2026-63877","urls":{"html":"https://cve.report/CVE-2026-63877","api":"https://cve.report/api/cve/CVE-2026-63877.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-63877","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-63877"},"summary":{"title":"serial: dz: Convert to use a platform device","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nserial: dz: Convert to use a platform device\n\nPrevent a crash from happening as the first serial port is initialised:\n\n  Console: switching to colour frame buffer device 160x64\n  tgafb: SFB+ detected, rev=0x02\n  fb0: Digital ZLX-E1 frame buffer device at 0x1e000000\n  DECstation DZ serial driver version 1.04\n  CPU 0 Unable to handle kernel paging request at virtual address 000000bc, epc == 8048b3a4, ra == 80470a78\n  Oops[#1]:\n  CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.19.0-dirty #35 NONE\n  $ 0   : 00000000 1000ac00 00000004 804707ac\n  $ 4   : 00000000 80e20850 80e20858 81000030\n  $ 8   : 00000000 8072c81c 00000008 fefefeff\n  $12   : 6c616972 00000006 80c5917f 69726420\n  $16   : 80e20800 00000000 808f8968 80e20800\n  $20   : 00000000 807f5a90 808b0094 808d3bc8\n  $24   : 00000018 80479030\n  $28   : 80c2e000 80c2fd70 00000069 80470a78\n  Hi    : 00000004\n  Lo    : 00000000\n  epc   : 8048b3a4 __dev_fwnode+0x0/0xc\n  ra    : 80470a78 serial_base_ctrl_add+0xa0/0x168\n  Status: 1000ac04\tIEp\n  Cause : 30000008 (ExcCode 02)\n  BadVA : 000000bc\n  PrId  : 00000220 (R3000)\n  Modules linked in:\n  Process swapper/0 (pid: 1, threadinfo=(ptrval), task=(ptrval), tls=00000000)\n  Stack : 00400044 00400040 8046f4cc 00000000 808a6148 808a0000 808f8968 8086983c\n          808e0000 8046fc84 1000ac01 00000028 80e20700 802ba3f8 80e20700 80d34a94\n          80c1b900 80e20700 80e20700 80e20700 80e20700 80444650 00000000 00000000\n          00000000 807f5a90 808b0094 80447080 00400040 808e0000 80d34a94 808a6148\n          80d34a94 00000004 80e20700 00000000 8076974c 80469810 80c2fe3c 1000ac01\n          ...\n  Call Trace:\n  [<8048b3a4>] __dev_fwnode+0x0/0xc\n  [<80470a78>] serial_base_ctrl_add+0xa0/0x168\n  [<8046fc84>] serial_core_register_port+0x1c8/0x974\n  [<808c6af0>] dz_init+0x74/0xc8\n  [<800470e0>] do_one_initcall+0x44/0x2d4\n  [<808b111c>] kernel_init_freeable+0x258/0x308\n  [<8072e434>] kernel_init+0x20/0x114\n  [<80049cd0>] ret_from_kernel_thread+0x14/0x1c\n\n  Code: 27bd0018  03e00008  2402ffea <8c8200bc> 03e00008  00000000  27bdffc0  afbe0038  afb30024\n\n  ---[ end trace 0000000000000000 ]---\n\n-- where a pointer is dereferenced that has been derived from a null\npointer to the port's parent device.\n\nSince no device is available with legacy probing and it's not anymore a\npreferable way to discover devices anyway, switch the driver to using a\nplatform device and use it as the port's parent device.  Update resource\nhandling accordingly and only request the actual span of addresses used\nwithin the slot, which will have had its resource already requested by\ngeneric platform device code.\n\nUse platform_driver_probe() not just because the DZ device is fixed with\nsolder on board and not straightforward to remove, but foremost because\nthe associated TTY's major device number is the same as used by the zs\ndriver and the first driver to claim it will prevent the other one from\nusing it.  Either one DZ device or some SCC devices will be present in a\ngiven system but never both at a time, and therefore we want the major\ndevice number to be claimed by the first driver to actually successfully\nbind to its device and platform_driver_probe() is a way to fulfil that.\n\nAn unfortunate consequence of the switch to a platform device is we now\nhand the console over from the bootconsole much later in the bootstrap.\nThe firmware console handler appears good enough though to work so late\nand in particular with interrupts enabled.\n\nConversely only starting the console port so late lets the reset code\nfully utilise our delay handlers, so switch from udelay() to fsleep()\nfor transmitter draining so as to avoid busy-waiting for an excessive\namount of time.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-07-19 16:17:04","updated_at":"2026-07-19 16:17:04"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/c9e78361fe92fb64662fc3c8f34e2cdbb8c25bc6","name":"https://git.kernel.org/stable/c/c9e78361fe92fb64662fc3c8f34e2cdbb8c25bc6","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/5c9fb95c8d6430d11dbb7b44fbe23222585cda86","name":"https://git.kernel.org/stable/c/5c9fb95c8d6430d11dbb7b44fbe23222585cda86","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/6f59646229490a93cda950017ad4bdfbfe770a1d","name":"https://git.kernel.org/stable/c/6f59646229490a93cda950017ad4bdfbfe770a1d","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/2ff0401ffddaccc85f758c8259912d686d052b31","name":"https://git.kernel.org/stable/c/2ff0401ffddaccc85f758c8259912d686d052b31","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/5d7a49d60b8fda66da60e240fd7315232fa1754f","name":"https://git.kernel.org/stable/c/5d7a49d60b8fda66da60e240fd7315232fa1754f","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63877","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63877","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 84a9582fd203063cd4d301204971ff2cd8327f1a c9e78361fe92fb64662fc3c8f34e2cdbb8c25bc6 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 84a9582fd203063cd4d301204971ff2cd8327f1a 6f59646229490a93cda950017ad4bdfbfe770a1d git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 84a9582fd203063cd4d301204971ff2cd8327f1a 2ff0401ffddaccc85f758c8259912d686d052b31 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 84a9582fd203063cd4d301204971ff2cd8327f1a 5c9fb95c8d6430d11dbb7b44fbe23222585cda86 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 84a9582fd203063cd4d301204971ff2cd8327f1a 5d7a49d60b8fda66da60e240fd7315232fa1754f git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.5","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.5 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.143 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.93 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.35 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.0.12 7.0.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"63877","cve":"CVE-2026-63877","epss":"0.002090000","percentile":"0.111450000","score_date":"2026-07-20","updated_at":"2026-07-21 00:13:14"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/mips/dec/platform.c","drivers/tty/serial/dz.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c9e78361fe92fb64662fc3c8f34e2cdbb8c25bc6","status":"affected","version":"84a9582fd203063cd4d301204971ff2cd8327f1a","versionType":"git"},{"lessThan":"6f59646229490a93cda950017ad4bdfbfe770a1d","status":"affected","version":"84a9582fd203063cd4d301204971ff2cd8327f1a","versionType":"git"},{"lessThan":"2ff0401ffddaccc85f758c8259912d686d052b31","status":"affected","version":"84a9582fd203063cd4d301204971ff2cd8327f1a","versionType":"git"},{"lessThan":"5c9fb95c8d6430d11dbb7b44fbe23222585cda86","status":"affected","version":"84a9582fd203063cd4d301204971ff2cd8327f1a","versionType":"git"},{"lessThan":"5d7a49d60b8fda66da60e240fd7315232fa1754f","status":"affected","version":"84a9582fd203063cd4d301204971ff2cd8327f1a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/mips/dec/platform.c","drivers/tty/serial/dz.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.5"},{"lessThan":"6.5","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.143","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.93","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.35","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.143","versionStartIncluding":"6.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.93","versionStartIncluding":"6.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.35","versionStartIncluding":"6.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.0.12","versionStartIncluding":"6.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1","versionStartIncluding":"6.5","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nserial: dz: Convert to use a platform device\n\nPrevent a crash from happening as the first serial port is initialised:\n\n  Console: switching to colour frame buffer device 160x64\n  tgafb: SFB+ detected, rev=0x02\n  fb0: Digital ZLX-E1 frame buffer device at 0x1e000000\n  DECstation DZ serial driver version 1.04\n  CPU 0 Unable to handle kernel paging request at virtual address 000000bc, epc == 8048b3a4, ra == 80470a78\n  Oops[#1]:\n  CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.19.0-dirty #35 NONE\n  $ 0   : 00000000 1000ac00 00000004 804707ac\n  $ 4   : 00000000 80e20850 80e20858 81000030\n  $ 8   : 00000000 8072c81c 00000008 fefefeff\n  $12   : 6c616972 00000006 80c5917f 69726420\n  $16   : 80e20800 00000000 808f8968 80e20800\n  $20   : 00000000 807f5a90 808b0094 808d3bc8\n  $24   : 00000018 80479030\n  $28   : 80c2e000 80c2fd70 00000069 80470a78\n  Hi    : 00000004\n  Lo    : 00000000\n  epc   : 8048b3a4 __dev_fwnode+0x0/0xc\n  ra    : 80470a78 serial_base_ctrl_add+0xa0/0x168\n  Status: 1000ac04\tIEp\n  Cause : 30000008 (ExcCode 02)\n  BadVA : 000000bc\n  PrId  : 00000220 (R3000)\n  Modules linked in:\n  Process swapper/0 (pid: 1, threadinfo=(ptrval), task=(ptrval), tls=00000000)\n  Stack : 00400044 00400040 8046f4cc 00000000 808a6148 808a0000 808f8968 8086983c\n          808e0000 8046fc84 1000ac01 00000028 80e20700 802ba3f8 80e20700 80d34a94\n          80c1b900 80e20700 80e20700 80e20700 80e20700 80444650 00000000 00000000\n          00000000 807f5a90 808b0094 80447080 00400040 808e0000 80d34a94 808a6148\n          80d34a94 00000004 80e20700 00000000 8076974c 80469810 80c2fe3c 1000ac01\n          ...\n  Call Trace:\n  [<8048b3a4>] __dev_fwnode+0x0/0xc\n  [<80470a78>] serial_base_ctrl_add+0xa0/0x168\n  [<8046fc84>] serial_core_register_port+0x1c8/0x974\n  [<808c6af0>] dz_init+0x74/0xc8\n  [<800470e0>] do_one_initcall+0x44/0x2d4\n  [<808b111c>] kernel_init_freeable+0x258/0x308\n  [<8072e434>] kernel_init+0x20/0x114\n  [<80049cd0>] ret_from_kernel_thread+0x14/0x1c\n\n  Code: 27bd0018  03e00008  2402ffea <8c8200bc> 03e00008  00000000  27bdffc0  afbe0038  afb30024\n\n  ---[ end trace 0000000000000000 ]---\n\n-- where a pointer is dereferenced that has been derived from a null\npointer to the port's parent device.\n\nSince no device is available with legacy probing and it's not anymore a\npreferable way to discover devices anyway, switch the driver to using a\nplatform device and use it as the port's parent device.  Update resource\nhandling accordingly and only request the actual span of addresses used\nwithin the slot, which will have had its resource already requested by\ngeneric platform device code.\n\nUse platform_driver_probe() not just because the DZ device is fixed with\nsolder on board and not straightforward to remove, but foremost because\nthe associated TTY's major device number is the same as used by the zs\ndriver and the first driver to claim it will prevent the other one from\nusing it.  Either one DZ device or some SCC devices will be present in a\ngiven system but never both at a time, and therefore we want the major\ndevice number to be claimed by the first driver to actually successfully\nbind to its device and platform_driver_probe() is a way to fulfil that.\n\nAn unfortunate consequence of the switch to a platform device is we now\nhand the console over from the bootconsole much later in the bootstrap.\nThe firmware console handler appears good enough though to work so late\nand in particular with interrupts enabled.\n\nConversely only starting the console port so late lets the reset code\nfully utilise our delay handlers, so switch from udelay() to fsleep()\nfor transmitter draining so as to avoid busy-waiting for an excessive\namount of time."}],"providerMetadata":{"dateUpdated":"2026-07-19T14:54:50.257Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/c9e78361fe92fb64662fc3c8f34e2cdbb8c25bc6"},{"url":"https://git.kernel.org/stable/c/6f59646229490a93cda950017ad4bdfbfe770a1d"},{"url":"https://git.kernel.org/stable/c/2ff0401ffddaccc85f758c8259912d686d052b31"},{"url":"https://git.kernel.org/stable/c/5c9fb95c8d6430d11dbb7b44fbe23222585cda86"},{"url":"https://git.kernel.org/stable/c/5d7a49d60b8fda66da60e240fd7315232fa1754f"}],"title":"serial: dz: Convert to use a platform device","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-63877","datePublished":"2026-07-19T14:54:50.257Z","dateReserved":"2026-07-19T07:54:57.018Z","dateUpdated":"2026-07-19T14:54:50.257Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-07-19 16:17:04","lastModifiedDate":"2026-07-19 16:17:04","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"63877","Ordinal":"1","Title":"serial: dz: Convert to use a platform device","CVE":"CVE-2026-63877","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"63877","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nserial: dz: Convert to use a platform device\n\nPrevent a crash from happening as the first serial port is initialised:\n\n  Console: switching to colour frame buffer device 160x64\n  tgafb: SFB+ detected, rev=0x02\n  fb0: Digital ZLX-E1 frame buffer device at 0x1e000000\n  DECstation DZ serial driver version 1.04\n  CPU 0 Unable to handle kernel paging request at virtual address 000000bc, epc == 8048b3a4, ra == 80470a78\n  Oops[#1]:\n  CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.19.0-dirty #35 NONE\n  $ 0   : 00000000 1000ac00 00000004 804707ac\n  $ 4   : 00000000 80e20850 80e20858 81000030\n  $ 8   : 00000000 8072c81c 00000008 fefefeff\n  $12   : 6c616972 00000006 80c5917f 69726420\n  $16   : 80e20800 00000000 808f8968 80e20800\n  $20   : 00000000 807f5a90 808b0094 808d3bc8\n  $24   : 00000018 80479030\n  $28   : 80c2e000 80c2fd70 00000069 80470a78\n  Hi    : 00000004\n  Lo    : 00000000\n  epc   : 8048b3a4 __dev_fwnode+0x0/0xc\n  ra    : 80470a78 serial_base_ctrl_add+0xa0/0x168\n  Status: 1000ac04\tIEp\n  Cause : 30000008 (ExcCode 02)\n  BadVA : 000000bc\n  PrId  : 00000220 (R3000)\n  Modules linked in:\n  Process swapper/0 (pid: 1, threadinfo=(ptrval), task=(ptrval), tls=00000000)\n  Stack : 00400044 00400040 8046f4cc 00000000 808a6148 808a0000 808f8968 8086983c\n          808e0000 8046fc84 1000ac01 00000028 80e20700 802ba3f8 80e20700 80d34a94\n          80c1b900 80e20700 80e20700 80e20700 80e20700 80444650 00000000 00000000\n          00000000 807f5a90 808b0094 80447080 00400040 808e0000 80d34a94 808a6148\n          80d34a94 00000004 80e20700 00000000 8076974c 80469810 80c2fe3c 1000ac01\n          ...\n  Call Trace:\n  [<8048b3a4>] __dev_fwnode+0x0/0xc\n  [<80470a78>] serial_base_ctrl_add+0xa0/0x168\n  [<8046fc84>] serial_core_register_port+0x1c8/0x974\n  [<808c6af0>] dz_init+0x74/0xc8\n  [<800470e0>] do_one_initcall+0x44/0x2d4\n  [<808b111c>] kernel_init_freeable+0x258/0x308\n  [<8072e434>] kernel_init+0x20/0x114\n  [<80049cd0>] ret_from_kernel_thread+0x14/0x1c\n\n  Code: 27bd0018  03e00008  2402ffea <8c8200bc> 03e00008  00000000  27bdffc0  afbe0038  afb30024\n\n  ---[ end trace 0000000000000000 ]---\n\n-- where a pointer is dereferenced that has been derived from a null\npointer to the port's parent device.\n\nSince no device is available with legacy probing and it's not anymore a\npreferable way to discover devices anyway, switch the driver to using a\nplatform device and use it as the port's parent device.  Update resource\nhandling accordingly and only request the actual span of addresses used\nwithin the slot, which will have had its resource already requested by\ngeneric platform device code.\n\nUse platform_driver_probe() not just because the DZ device is fixed with\nsolder on board and not straightforward to remove, but foremost because\nthe associated TTY's major device number is the same as used by the zs\ndriver and the first driver to claim it will prevent the other one from\nusing it.  Either one DZ device or some SCC devices will be present in a\ngiven system but never both at a time, and therefore we want the major\ndevice number to be claimed by the first driver to actually successfully\nbind to its device and platform_driver_probe() is a way to fulfil that.\n\nAn unfortunate consequence of the switch to a platform device is we now\nhand the console over from the bootconsole much later in the bootstrap.\nThe firmware console handler appears good enough though to work so late\nand in particular with interrupts enabled.\n\nConversely only starting the console port so late lets the reset code\nfully utilise our delay handlers, so switch from udelay() to fsleep()\nfor transmitter draining so as to avoid busy-waiting for an excessive\namount of time.","Type":"Description","Title":"serial: dz: Convert to use a platform device"}]}}}