Executive brief
A vulnerability in the Linux kernel's serial communication component can cause the system to hang or become unresponsive. This occurs when certain serial ports are not properly initialized, leading to an infinite loop during data transmission. An attacker with local access could exploit this to cause a denial-of-service, impacting system availability and operations.
Technical details
A logic inconsistency exists between uart_write_room() and uart_write() in the Linux kernel's serial core. When a serial port is of type PORT_UNKNOWN and its xmit_buf is NULL, uart_write_room() incorrectly returns a positive value from kfifo_avail(), while uart_write() returns 0. Drivers that rely on tty_write_room() to gate writes (such as caif_serial) enter an infinite loop because they believe space is available, but the subsequent write operation fails to progress. This results in a kernel-level infinite loop and system hang (CWE-835). The issue is resolved by ensuring uart_write_room() checks for a NULL xmit_buf and returns 0, matching the behavior of uart_write().
Affected products
- Linux Linux Kernel 6.19 to 6.19.10, 2.6.12.1 to 6.18.20
Timeline
- 2026-04-03: disclosed
- 2026-03-12: patched: Initial patch committed to stable tree