Executive brief
A vulnerability exists in the Linux kernel's PCH UART driver, which is used for serial communication on certain hardware platforms. Under specific low-memory conditions, the system could experience a kernel crash (NULL pointer dereference) when attempting to set up direct memory access (DMA) for data reception. This could lead to a local denial-of-service, impacting system stability and availability.
Technical details
A vulnerability in the Linux kernel's tty serial driver for PCH UART (drivers/tty/serial/pch_uart.c) arises from the lack of a return value check for dma_alloc_coherent() in the pch_request_dma() function. If memory allocation fails, the driver continues execution with a NULL pointer, leading to a dereference in dma_handle_rx(). An attacker with sufficient privileges to trigger DMA requests or a system under extreme memory pressure could cause a kernel oops/panic. The fix introduces a check for the allocation result and implements a proper cleanup sequence (goto ladder) to release previously allocated DMA channels and PCI device references. Patches have been backported to multiple stable kernel branches including 5.10.y, 5.15.y, 6.1.y, and 6.6.y.
Affected products
- Linux Linux 2.6.38 to 6.9.x
Timeline
- 2026-04-09: other: Patch authored
- 2026-07-24: disclosed: CVE published
References
- https://git.kernel.org/stable/c/5f2e2a240dc1846e049bc67e9c3cdf5b031d08bf
- https://git.kernel.org/stable/c/66f8bfea055b23719b4fd6ce207c44de37d82a59
- https://git.kernel.org/stable/c/6dd5c0ea139b586ad5a091677056dafd405cfe82
- https://git.kernel.org/stable/c/6fe472c1bbbe238e91141f7cabc1226e96a60d43
- https://git.kernel.org/stable/c/760df81763b391bb5f0dcb0b7597b736da753ae4
- https://git.kernel.org/stable/c/d846df2dfbc2469a688833b4cc4f8aa80672bde8
- https://git.kernel.org/stable/c/d8d53a343ebe74274ca17b1e1993042e99f8c863