Executive brief
A vulnerability in the Linux kernel's serial driver can cause a system deadlock when using Direct Memory Access (DMA) for data transfers. This component is responsible for managing communication with serial hardware devices. An exploit could allow a local user to trigger a permanent hang of serial communications, leading to a partial denial of service or system instability.
Technical details
A race condition and improper state management exist in the 8250 serial driver's DMA implementation. The `dmaengine_terminate_async` function does not guarantee that the `__dma_tx_complete` callback will execute. Because this callback was the sole location for clearing the `dma->tx_running` flag, a canceled transaction that fails to trigger the callback leaves the driver in a state where it believes a transmission is still active. This prevents the scheduling of any subsequent TX DMA transactions, effectively deadlocking the serial port's transmit capability. The fix involves explicitly clearing the `tx_running` flag after termination while holding the UART port lock to ensure serialized access.
Affected products
- Linux Linux Kernel 5.4.291 to 5.5; 5.10.235 to 5.10.253; 5.15.179 to 5.15.203; 6.1.129 to 6.1.167; 6.6.79 to 6.6.130; 6.12.16 to 6.12.78; 6.13.4 to 6.14; 6.19 to 6.19.10
Timeline
- 2026-02-09: other: Vulnerability fixed in upstream commits
- 2026-05-05: disclosed: CVE published
References
- https://git.kernel.org/stable/c/2a72403b985aea6b4aac3171830492f9a387f9e1
- https://git.kernel.org/stable/c/5f6b17562f03fc65c7d3474ef8f1959b19d1ca41
- https://git.kernel.org/stable/c/79a19bd936bb35f56ef0ccab1b3b59ebce8c762d
- https://git.kernel.org/stable/c/8190f9ab6ad90cb97652adbebd238b874a4ef70d
- https://git.kernel.org/stable/c/a424a34b8faddf97b5af41689087e7a230f79ba7
- https://git.kernel.org/stable/c/b5ad887339503103d0fbe9827b16ad287597c275
- https://git.kernel.org/stable/c/d2719a0a9c3439abf67843a5504b7afccd9ded93