CVE-2026-63883
Received Received - Intake

Race Condition in Linux Kernel Serial Driver Leads to DMA Stale Data

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ When uart_flush_buffer() runs before the DMA completion IRQ is delivered, the following race can occur (all steps serialized by uart_port_lock): 1. DMA starts: tx_remaining = N, kfifo contains N bytes 2. DMA completes in hardware; IRQ is pending but not yet delivered 3. uart_flush_buffer() acquires the port lock and calls kfifo_reset(), making kfifo_len() = 0 while tx_remaining remains N 4. uart_flush_buffer() releases the port lock 5. DMA IRQ fires; handle_tx_dma() acquires the port lock and calls uart_xmit_advance(uport, tx_remaining) on an empty kfifo uart_xmit_advance() increments kfifo->out by tx_remaining. Since kfifo_reset() already set both in and out to 0, out wraps past in, causing kfifo_len() to return UART_XMIT_SIZE - tx_remaining. The next start_tx_dma() call then submits a DMA transfer of stale buffer data. Fix this by snapshotting kfifo_len() at the start of handle_tx_dma() and skipping uart_xmit_advance() when fifo_len < tx_remaining, which indicates the kfifo was reset by a preceding flush.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63883
EUVD
EUVD-2026-45768

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition in the Qualcomm Generic Interface (GENI) serial driver. When a DMA transfer completes but its interrupt hasn't been processed yet, a flush operation can reset the FIFO buffer while the DMA system still thinks data remains. This causes the kernel to incorrectly advance the FIFO pointer past its valid range, leading to potential data corruption or system instability.

Detection Guidance

This vulnerability is specific to the Linux kernel's serial driver for Qualcomm platforms. Detection requires checking the kernel version and examining the qcom_geni serial driver code for the race condition described. No network-based detection is applicable. Check kernel logs for DMA-related errors or unusual UART behavior.

Impact Analysis

If exploited, this could cause system crashes, data corruption in serial communications, or unexpected behavior in applications relying on serial ports. It primarily affects systems using Qualcomm SoCs with DMA-enabled serial ports, potentially disrupting critical communication channels.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-level kernel race condition in serial communication handling. It may indirectly impact systems requiring strict data integrity if exploited, but no evidence suggests direct regulatory non-compliance.

Mitigation Strategies

Apply the kernel patch that fixes the kfifo underflow issue in the qcom_geni serial driver. Update to a kernel version containing the fix. If immediate patching is not possible, disable DMA for the affected serial ports as a workaround.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63883. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart