CVE-2026-63883

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ

When uart_flush_buffer() runs before the DMA completion IRQ is delivered,

the following race can occur (all steps serialized by uart_port_lock):

1. DMA starts: tx_remaining = N, kfifo contains N bytes

2. DMA completes in hardware; IRQ is pending but not yet delivered

3. uart_flush_buffer() acquires the port lock and calls kfifo_reset(),

making kfifo_len() = 0 while tx_remaining remains N

4. uart_flush_buffer() releases the port lock

5. DMA IRQ fires; handle_tx_dma() acquires the port lock and calls

uart_xmit_advance(uport, tx_remaining) on an empty kfifo

uart_xmit_advance() increments kfifo->out by tx_remaining. Since

kfifo_reset() already set both in and out to 0, out wraps past in,

causing kfifo_len() to return UART_XMIT_SIZE - tx_remaining. The next

start_tx_dma() call then submits a DMA transfer of stale buffer dat

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References