CVE-2026-64528

tty: serial: samsung: Remove redundant port lock acquisition in rx helpers

N/A
Published: July 25, 2026 at 09:20 AM UTC
Updated: July 25, 2026 at 10:31 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
N/A
Exploit prediction
EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: tty: serial: samsung: Remove redundant port lock acquisition in rx helpers Sashiko identified a deadlock when the console flow is engaged [1]. When console flow control is enabled (UPF_CONS_FLOW), s3c24xx_serial_stop_tx() calls s3c24xx_serial_rx_enable() and s3c24xx_serial_start_tx() calls s3c24xx_serial_rx_disable(). The serial core framework invokes the .stop_tx() and .start_tx() callbacks with the port->lock spinlock already held. Furthermore, all internal driver paths that invoke stop_tx (such as the DMA TX completion handler s3c24xx_serial_tx_dma_complete() or the PIO TX IRQ handler s3c24xx_serial_tx_irq()) also acquire port->lock prior to calling it. (Note that s3c24xx_serial_start_tx() is only invoked by the serial core). However, s3c24xx_serial_rx_enable() and s3c24xx_serial_rx_disable() unconditionally attempt to acquire port->lock again using uart_port_lock_irqsave(). Since spinlocks are not recursive, this causes a deadlock on the same CPU when console flow control is engaged. Remove the redundant lock acquisition from both rx helper functions.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

2.6.27 ≤ v < 5.10.2592.6.27 ≤ v < 5.15.2102.6.27 ≤ v < 6.1.1762.6.27 ≤ v < 6.12.932.6.27 ≤ v < 6.18.352.6.27 ≤ v < 6.6.1432.6.27 ≤ v < 7.0.122.6.27 ≤ v < 7.12.6.27b497549a035c2a81b71c7a27f2b00c8a16c09423
Vendor states this is fixed in 10014eb7eee351f7b587f8ac85830f0c9343cb9a (fixed)
Vendor states this is fixed in 14143ec10d69f42806b5d7b046f0fd1b835831ae (fixed)
Vendor states this is fixed in 9c92b42207978559e32903c3098aaf5c5b5788b2 (fixed)
Vendor states this is fixed in 9fd48937046efc9abb89379d63ee9cc5c661d711 (fixed)
Vendor states this is fixed in a3bb136bff5e6a5e48cdd813246c9c4686feaaa9 (fixed)
Vendor states this is fixed in a9c22e0f93ba18322a6623ecdda2f0cd858ca350 (fixed)
Vendor states this is fixed in ee9eb72be95490602c493db050c73d925c3a4d74 (fixed)
Vendor states this is fixed in f4c3e63fa8639aedf96fb200d9939945a9eed51e (fixed)
Vendor states this is fixed in 2.6.27 (unaffected)
Vendor states this is fixed in 5.10.259 (unaffected)
Vendor states this is fixed in 5.15.210 (unaffected)
Vendor states this is fixed in 6.1.176 (unaffected)
Vendor states this is fixed in 6.12.93 (unaffected)
Vendor states this is fixed in 6.18.35 (unaffected)
Vendor states this is fixed in 6.6.143 (unaffected)
Vendor states this is fixed in 7.0.12 (unaffected)
Vendor states this is fixed in 7.1 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

Quick Info

StatusRECEIVED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card