CVE-2026-74655
Received Received - Intake

UART TX DMA Buffer Flush Flaw in Linux Kernel

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: serial: qcom-geni: fix TX DMA buffer flush When transmit flushing a qcom-geni UART during an ongoing TX DMA, the UART gets stuck infinitely repeating corrupted TX DMA frames. The DMA-mode uart_ops does not provide a flush_buffer callback, so an in-flight transfer can complete after serial core has reset the transmit kfifo, underflowing its length and resubmitting page-sized transfers indefinitely. Add one that stops the transfer and clears tx_remaining and tx_queued. The stop path was also broken: it unmapped the buffer while the serial engine could still read it, and never reset the TX DMA state machine. Cancel the main sequencer command first, then reset the state machine and wait for it before unmapping. Drop the early return so a pending mapping is also cleaned up when the main command is inactive. The bug can be triggered from userspace with a large write immediately followed by TCOFLUSH. A following tcdrain will hang forever. The bug was reproduced and this fix was validated on Arduino Uno Q (QRB2210) using /dev/ttyHS1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74655
EUVD
EUVD-2026-64592

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
qualcomm qcom_geni *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the Qualcomm Generic Interface (qcom-geni) UART serial driver. It causes the UART to get stuck in an infinite loop transmitting corrupted data when DMA is flushed during an active TX transfer. The issue stems from missing a flush_buffer callback and improper cleanup of DMA state during buffer flushing.

Detection Guidance

This vulnerability is specific to the Linux kernel's qcom-geni UART driver and may not have direct network detection methods. Check if your system uses Qualcomm Geni UART hardware by inspecting kernel logs or device tree configurations. Look for symptoms like system hangs during UART operations or infinite TX DMA transfers.

Impact Analysis

The vulnerability can cause system hangs when userspace performs a large write followed by TCOFLUSH and then tcdrain. This would freeze the system indefinitely, requiring a reboot. It specifically affects systems using Qualcomm Geni UART with DMA mode enabled.

Mitigation Strategies

Apply the kernel patch that adds the flush_buffer callback and fixes the TX DMA state machine. Update to a Linux kernel version that includes this fix. Avoid triggering the bug by not using large writes followed by TCOFLUSH on affected UART devices.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74655. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart