CVE-2026-74654
Received Received - Intake

Race Condition in Linux Kernel Serial 8250 DMA

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: serial: 8250_dma: Clear stale RX state on shutdown serial8250_release_dma() terminates RX DMA and releases the channel, but leaves rx_running set. If the port is closed while an RX transfer is active, the stale state remains while rxchan is NULL until the channel is requested again on the next open. The DesignWare BUSY workaround added by commit a7b9ce39fbe4 ("serial: 8250_dw: Ensure BUSY is deasserted") calls serial8250_rx_dma_flush() from the LCR write path during startup. This happens before serial8250_request_dma() obtains a new RX channel. On reopen, the stale rx_running state therefore makes the flush path pass a NULL channel to dmaengine_pause(), causing a kernel Oops. Clear rx_running after terminating RX DMA, matching the TX cleanup. Also make the flush helper return if the DMA object or RX channel is not available so startup and teardown paths cannot pass a NULL channel to the DMAengine API.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74654
EUVD
EUVD-2026-64591

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where the serial port's RX DMA state is not properly cleared when shutting down. If a port is closed during an active RX transfer, the stale state remains until the port is reopened, potentially causing a kernel crash (Oops) when the DMA engine API receives a NULL channel.

Detection Guidance

This vulnerability is specific to the Linux kernel's serial 8250 DMA handling and does not have network-based detection methods. Detection requires checking kernel logs for Oops messages related to DMA operations or serial port handling. Monitor dmesg or system logs for errors during serial port initialization or DMA operations.

Impact Analysis

This vulnerability can cause system instability or crashes when serial ports are frequently opened and closed, particularly in systems using DMA for serial communication. It may lead to unexpected kernel errors or require a reboot to recover.

Mitigation Strategies

Apply the latest Linux kernel updates to patch this vulnerability. If immediate patching is not possible, avoid closing serial ports while RX transfers are active. Monitor kernel logs for Oops messages and restrict access to serial devices if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74654. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart