CVE-2026-90834 UART wide-data syscall verifiers check the 8-bit driver op, allowing a user-mode thread to trigger a NULL function-pointer call in kernel mode

The user-mode syscall verifiers for the 16-bit "wide data" UART API in drivers/serial/uarthandlers.c validated the wrong driver operation. zvrfyuartpolloutu16, zvrfyuarttxu16 and zvrfyuartrxenableu16 each ran KSYSCALLDRIVERUART against the 8-bit op pollout, tx, rxenable rather than the 16-bit op...