« Volver al listado

CVE-2026-64528

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

tty: serial: samsung: Remove redundant port lock acquisition in rx helpers

Sashiko identified a deadlock when the console flow is engaged [1].

When console flow control is enabled (UPF_CONS_FLOW), s3c24xx_serial_stop_tx() calls s3c24xx_serial_rx_enable() and s3c24xx_serial_start_tx() calls s3c24xx_serial_rx_disable().

The serial core framework invokes the .stop_tx() and .start_tx() callbacks with the port->lock spinlock already held.

Leer descripción completaMostrar menos

Furthermore, all internal driver paths that invoke stop_tx (such as the DMA TX completion handler s3c24xx_serial_tx_dma_complete() or the PIO TX IRQ handler s3c24xx_serial_tx_irq()) also acquire port->lock prior to calling it. (Note that s3c24xx_serial_start_tx() is only invoked by the serial core).

However, s3c24xx_serial_rx_enable() and s3c24xx_serial_rx_disable() unconditionally attempt to acquire port->lock again using uart_port_lock_irqsave(). Since spinlocks are not recursive, this causes a deadlock on the same CPU when console flow control is engaged.

Remove the redundant lock acquisition from both rx helper functions.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-64528",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "b497549a035c2a81b71c7a27f2b00c8a16c09423",
              "lessThan": "ee9eb72be95490602c493db050c73d925c3a4d74",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b497549a035c2a81b71c7a27f2b00c8a16c09423",
              "lessThan": "10014eb7eee351f7b587f8ac85830f0c9343cb9a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b497549a035c2a81b71c7a27f2b00c8a16c09423",
              "lessThan": "f4c3e63fa8639aedf96fb200d9939945a9eed51e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b497549a035c2a81b71c7a27f2b00c8a16c09423",
              "lessThan": "a9c22e0f93ba18322a6623ecdda2f0cd858ca350",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b497549a035c2a81b71c7a27f2b00c8a16c09423",
              "lessThan": "14143ec10d69f42806b5d7b046f0fd1b835831ae",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b497549a035c2a81b71c7a27f2b00c8a16c09423",
              "lessThan": "9fd48937046efc9abb89379d63ee9cc5c661d711",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b497549a035c2a81b71c7a27f2b00c8a16c09423",
              "lessThan": "9c92b42207978559e32903c3098aaf5c5b5788b2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b497549a035c2a81b71c7a27f2b00c8a16c09423",
              "lessThan": "a3bb136bff5e6a5e48cdd813246c9c4686feaaa9",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/tty/serial/samsung_tty.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.27"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "2.6.27",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver",
              "lessThanOrEqual": "7.0.*"
            },
            {
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/tty/serial/samsung_tty.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-07-25T10:17:39.187",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/10014eb7eee351f7b587f8ac85830f0c9343cb9a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/14143ec10d69f42806b5d7b046f0fd1b835831ae",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9c92b42207978559e32903c3098aaf5c5b5788b2",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9fd48937046efc9abb89379d63ee9cc5c661d711",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a3bb136bff5e6a5e48cdd813246c9c4686feaaa9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a9c22e0f93ba18322a6623ecdda2f0cd858ca350",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ee9eb72be95490602c493db050c73d925c3a4d74",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f4c3e63fa8639aedf96fb200d9939945a9eed51e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: serial: samsung: Remove redundant port lock acquisition in rx helpers\n\nSashiko identified a deadlock when the console flow is engaged [1].\n\nWhen console flow control is enabled (UPF_CONS_FLOW),\ns3c24xx_serial_stop_tx() calls s3c24xx_serial_rx_enable() and\ns3c24xx_serial_start_tx() calls s3c24xx_serial_rx_disable().\n\nThe serial core framework invokes the .stop_tx() and .start_tx()\ncallbacks with the port->lock spinlock already held. Furthermore, all\ninternal driver paths that invoke stop_tx (such as the DMA TX\ncompletion handler s3c24xx_serial_tx_dma_complete() or the PIO TX IRQ\nhandler s3c24xx_serial_tx_irq()) also acquire port->lock prior to\ncalling it. (Note that s3c24xx_serial_start_tx() is only invoked by the\nserial core).\n\nHowever, s3c24xx_serial_rx_enable() and s3c24xx_serial_rx_disable()\nunconditionally attempt to acquire port->lock again using\nuart_port_lock_irqsave(). Since spinlocks are not recursive, this\ncauses a deadlock on the same CPU when console flow control is engaged.\n\nRemove the redundant lock acquisition from both rx helper functions."
    }
  ],
  "lastModified": "2026-07-25T10:17:39.187",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}