Executive brief
A bug in the Linux kernel's Qualcomm GENI UART driver can cause the serial port to hang indefinitely when transmitting data over DMA and then flushing the buffer. A user can trigger this with a large write followed by a flush command, causing the device to become unresponsive and requiring a reboot. This affects embedded systems and devices using the QRB2210 chipset.
Technical details
The vulnerability is a resource state management bug in the qcom-geni serial driver's TX DMA path. When the serial core flushes the transmit buffer during an ongoing DMA transfer, the driver lacks a flush_buffer callback, allowing in-flight transfers to complete after the kfifo is reset. This causes the DMA engine to underflow and repeatedly resubmit corrupted frames indefinitely. Additionally, the TX stop path unmaps DMA buffers while the hardware can still access them and fails to reset the DMA state machine. The fix adds a flush_buffer_dma callback to properly stop transfers, adds proper DMA state machine reset sequencing (cancel command, reset state machine, wait for completion, then unmap), and removes an early return that skipped cleanup. The bug is reproducible via userspace with a large write immediately followed by TCOFLUSH, causing a subsequent tcdrain to hang forever.
Affected products
- Linux Linux kernel Multiple versions from linux-4.x through linux-7.x (qcom-geni-serial driver)
Timeline
- 2026-07-29: other: Upstream commit submitted by Jan Sebastian Götte
- 2026-08-22: disclosed: CVE-2026-74655 published
- 2026-08-19: patched: Fix merged into stable tree
- 2026-08-27: other: Stable tree commit by Greg Kroah-Hartman