PT-2026-37064 · Linux · Linux

Published 2026-05-05 · Updated 2026-05-05 · CVE-2026-43061

Mitre

In the Linux kernel, the following vulnerability has been resolved:

serial: 8250: Fix TX deadlock when using DMA

dmaengine terminate async does not guarantee that the dma tx complete callback will run. The callback is currently the only place where dma->tx running gets cleared. If the transaction is canceled and the callback never runs, then dma->tx running will never get cleared and we will never schedule new TX DMA transactions again.

This change makes it so we clear dma->tx running after we terminate the DMA transaction. This is "safe" because serial8250 tx dma flush is holding the UART port lock. The first thing the callback does is also grab the UART port lock, so access to dma->tx running is serialized.

Related Identifiers

CVE-2026-43061

Affected Products

Linux

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-43061 · Security Note
• https://git.kernel.org/stable/c/d2719a0a9c3439abf67843a5504b7afccd9ded93 · Note
• https://git.kernel.org/stable/c/f76d91271bcacbd759a2e4ee3ea61faa6a727ccf · Note
• https://git.kernel.org/stable/c/79a19bd936bb35f56ef0ccab1b3b59ebce8c762d · Note
• https://git.kernel.org/stable/c/8190f9ab6ad90cb97652adbebd238b874a4ef70d · Note
• https://git.kernel.org/stable/c/b5ad887339503103d0fbe9827b16ad287597c275 · Note
• https://git.kernel.org/stable/c/a424a34b8faddf97b5af41689087e7a230f79ba7 · Note
• https://git.kernel.org/stable/c/2a72403b985aea6b4aac3171830492f9a387f9e1 · Note
• https://git.kernel.org/stable/c/5f6b17562f03fc65c7d3474ef8f1959b19d1ca41 · Note