Executive brief
The Linux kernel's Qualcomm GENI serial driver has a race condition in its DMA transmission handling that can discard user data. When the serial buffer is flushed while a DMA transfer is in progress, subsequent data written by applications may be lost if it arrives before the stale DMA completion interrupt is processed. This can cause data corruption in serial communication on systems using this driver.
Technical details
The vulnerability is a race condition in the qcom_geni_serial DMA TX completion path. When uart_flush_buffer() is called after hardware completes a DMA transfer but before the completion interrupt is handled, the transmit FIFO is reset while port->tx_remaining still references the old transfer size. If new data is written before the stale completion handler runs, the handler may incorrectly advance the FIFO by tx_remaining bytes, discarding the new data. The fix introduces a tx_dma_stale flag to mark in-flight DMA transfers as stale when the FIFO is flushed, preventing the stale completion from advancing the FIFO while still properly cleaning up the DMA mapping. This is a local vulnerability requiring no network access, triggered through normal serial I/O operations.
Affected products
- Linux Linux kernel Multiple versions (4.x through 7.x and later)
Timeline
- 2026-09-17: disclosed
- 2026-09-14: patched: Fix committed to stable kernel branches