CVE-2024-44950

serial: sc16is7xx: fix invalid FIFO access with special register set

MEDIUM
5.5
CVSS Score
Published: September 4, 2024 at 06:35 PM UTC
Updated: August 5, 2026 at 12:04 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: serial: sc16is7xx: fix invalid FIFO access with special register set When enabling access to the special register set, Receiver time-out and RHR interrupts can happen. In this case, the IRQ handler will try to read from the FIFO thru the RHR register at address 0x00, but address 0x00 is mapped to DLL register, resulting in erroneous FIFO reading. Call graph example: sc16is7xx_startup(): entry sc16is7xx_ms_proc(): entry sc16is7xx_set_termios(): entry sc16is7xx_set_baud(): DLH/DLL = $009C --> access special register set sc16is7xx_port_irq() entry --> IIR is 0x0C sc16is7xx_handle_rx() entry sc16is7xx_fifo_read(): --> unable to access FIFO (RHR) because it is mapped to DLL (LCR=LCR_CONF_MODE_A) sc16is7xx_set_baud(): exit --> Restore access to general register set Fix the problem by claiming the efr_lock mutex when accessing the Special register set.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

3.16 ≤ v < 6.1.1203.16 ≤ v < 6.10.53.16 ≤ v < 6.113.16 ≤ v < 6.6.646.11 rc16.11 rc2dfeae619d781dee61666d5551b93ba3be755a86b
Vendor states this is fixed in 6a6730812220a9a5ce4003eb347da1ee5abd06b0 (fixed)
Vendor states this is fixed in 7d3b793faaab1305994ce568b59d61927235f57b (fixed)
Vendor states this is fixed in cc6a3f35bc9b3a8da1b195420a2e8d9fdadfa831 (fixed)
Vendor states this is fixed in dc5ead0e8fc5ef53b8553394d4aab60c277976b3 (fixed)
Vendor states this is fixed in 3.16 (unaffected)
Vendor states this is fixed in 6.1.120 (unaffected)
Vendor states this is fixed in 6.10.5 (unaffected)
Vendor states this is fixed in 6.11 (unaffected)
Vendor states this is fixed in 6.6.64 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

References (5)

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
NVD-CWE-noinfo

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card