PT-2026-61200 · Linux · Linux

CVE-2026-63883 · Published 2026-07-19 · Updated 2026-07-19

NVD

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

In the Linux kernel, the following vulnerability has been resolved:

serial: qcom geni: fix kfifo underflow when flush precedes DMA completion IRQ

When uart flush buffer() runs before the DMA completion IRQ is delivered, the following race can occur (all steps serialized by uart port lock):

1. DMA starts: tx remaining = N, kfifo contains N bytes
2. DMA completes in hardware; IRQ is pending but not yet delivered
3. uart flush buffer() acquires the port lock and calls kfifo reset(), making kfifo len() = 0 while tx remaining remains N
4. uart flush buffer() releases the port lock
5. DMA IRQ fires; handle tx dma() acquires the port lock and calls uart xmit advance(uport, tx remaining) on an empty kfifo

uart xmit advance() increments kfifo->out by tx remaining. Since kfifo reset() already set both in and out to 0, out wraps past in, causing kfifo len() to return UART XMIT SIZE - tx remaining. The next start tx dma() call then submits a DMA transfer of stale buffer data.

Fix this by snapshotting kfifo len() at the start of handle tx dma() and skipping uart xmit advance() when fifo len < tx remaining, which indicates the kfifo was reset by a preceding flush.

Fix

Related Identifiers

CVE-2026-63883

Affected Products

Linux

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-63883 · Security Note
• https://git.kernel.org/stable/c/452d6fa37ae9b021f4f6d397dbae077f7296f6f4 · Note
• https://git.kernel.org/stable/c/b1159dce10b38eb795e4c96cdc4d34b83cec81c5 · Note
• https://git.kernel.org/stable/c/654f45a8569f3cd6ff20bd724a18e0cce65893ba · Note
• https://git.kernel.org/stable/c/0d2c41a8b00934ddf8a7c1b4cf72dffa1e629c46 · Note
• https://git.kernel.org/stable/c/c91ea13375f70f6271a0183445e34e83b8f4d8f7 · Note