CVE-2026-74653

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx

The NXP LPC32xx UART (PORT_LPC3220) can latch an RX character-timeout

interrupt while the RX FIFO is empty: IIR reports UART_IIR_RX_TIMEOUT

(0x0c) but LSR.DR is clear. A character timeout is only cleared by

reading RHR, but serial8250_rx_chars() reads RHR only when LSR.DR is

set, so nothing ever clears the condition. The interrupt is

level-triggered and re-fires immediately, so on a single-core ARM926

the resulting interrupt storm livelocks the CPU.

It is reproducible when userspace repeatedly opens the front-panel port

(ttyS1): serial8250_do_set_termios() re-enables interrupts on unlock and

the handler then spins forever with iir=0xcc lsr=0x60 ier=0x05, tripping

the soft-lockup detector in serial8250_handle_irq_locked().

LPC32xx has no dedicated 8250 glue driver, it's driven by the generic

8250_of. Add a hardware specific handle_irq for PORT_LPC3220, wi

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References