Executive brief
A race condition in the Qualcomm serial driver for the Linux kernel could allow stale data to be transmitted over serial ports. This occurs when a buffer flush happens at the exact moment a data transfer completes, causing the system to miscalculate how much data is left. While primarily a technical stability issue, it could lead to minor data corruption or unexpected behavior in devices using these serial interfaces.
Technical details
A race condition exists in `drivers/tty/serial/qcom_geni_serial.c` when `uart_flush_buffer()` is called before a DMA completion interrupt is handled. If `kfifo_reset()` is executed during the flush, it clears the buffer while `tx_remaining` still holds a positive value. When the subsequent DMA IRQ fires, `handle_tx_dma()` calls `uart_xmit_advance()` with the stale `tx_remaining` value, causing the kfifo 'out' pointer to wrap past the 'in' pointer. This underflow results in a corrupted buffer length calculation, leading the next DMA operation to transmit stale data from the circular buffer. The fix involves checking the current kfifo length against `tx_remaining` before advancing the buffer.
Affected products
- Linux Linux Kernel 6.3 to 6.18.35
Timeline
- 2026-05-06: other: Patch submitted by developer
- 2026-07-19: disclosed: CVE published
References
- https://git.kernel.org/stable/c/0d2c41a8b00934ddf8a7c1b4cf72dffa1e629c46
- https://git.kernel.org/stable/c/452d6fa37ae9b021f4f6d397dbae077f7296f6f4
- https://git.kernel.org/stable/c/654f45a8569f3cd6ff20bd724a18e0cce65893ba
- https://git.kernel.org/stable/c/b1159dce10b38eb795e4c96cdc4d34b83cec81c5
- https://git.kernel.org/stable/c/c91ea13375f70f6271a0183445e34e83b8f4d8f7