Junglewise Threat Intelligence

CVE-2026-63883: Linux Kernel Qualcomm GENI serial driver kfifo underflow

CVE-2026-63883 · Severity: info · CVSS 4.4 · Published 2026-07-19

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A race condition in the Qualcomm serial driver for the Linux kernel could allow stale data to be transmitted over serial ports. This occurs when a buffer flush happens at the exact moment a data transfer completes, causing the system to miscalculate how much data is left. While primarily a technical stability issue, it could lead to minor data corruption or unexpected behavior in devices using these serial interfaces.

Technical details

A race condition exists in `drivers/tty/serial/qcom_geni_serial.c` when `uart_flush_buffer()` is called before a DMA completion interrupt is handled. If `kfifo_reset()` is executed during the flush, it clears the buffer while `tx_remaining` still holds a positive value. When the subsequent DMA IRQ fires, `handle_tx_dma()` calls `uart_xmit_advance()` with the stale `tx_remaining` value, causing the kfifo 'out' pointer to wrap past the 'in' pointer. This underflow results in a corrupted buffer length calculation, leading the next DMA operation to transmit stale data from the circular buffer. The fix involves checking the current kfifo length against `tx_remaining` before advancing the buffer.

Affected products

  • Linux Linux Kernel 6.3 to 6.18.35

Timeline

  • 2026-05-06: other: Patch submitted by developer
  • 2026-07-19: disclosed: CVE published

References

Related threats