Executive brief
A flaw in the Linux kernel's serial port driver can cause a system crash (kernel Oops) when a serial port is reopened after being closed during an active data transfer. This affects systems using DMA-based serial communication, particularly those with DesignWare UARTs, and could cause unexpected service interruptions or system downtime.
Technical details
The vulnerability is a null pointer dereference in the 8250_dma serial driver. When serial8250_release_dma() terminates an active RX DMA transfer and releases the channel, it fails to clear the rx_running flag. On port reopen, the DesignWare BUSY workaround calls serial8250_rx_dma_flush() during LCR write before requesting a new RX channel. The stale rx_running flag causes the flush path to call dmaengine_pause() with a NULL rxchan pointer, triggering a kernel Oops. The fix clears rx_running after terminating RX DMA and adds NULL checks in serial8250_rx_dma_flush() to prevent passing NULL pointers to the DMAengine API. Patches have been released and applied to kernel stable branches.
Affected products
- Linux Linux kernel various versions from 2.6.11 through 6.9 and later
Timeline
- 2026-08-22: disclosed
- 2026-08-19: patched: Fix commits applied to stable branches