Description
In the Linux kernel, the following vulnerability has been resolved:

tty: serial: samsung: Remove redundant port lock acquisition in rx helpers

Sashiko identified a deadlock when the console flow is engaged [1].

When console flow control is enabled (UPF_CONS_FLOW),
s3c24xx_serial_stop_tx() calls s3c24xx_serial_rx_enable() and
s3c24xx_serial_start_tx() calls s3c24xx_serial_rx_disable().

The serial core framework invokes the .stop_tx() and .start_tx()
callbacks with the port->lock spinlock already held. Furthermore, all
internal driver paths that invoke stop_tx (such as the DMA TX
completion handler s3c24xx_serial_tx_dma_complete() or the PIO TX IRQ
handler s3c24xx_serial_tx_irq()) also acquire port->lock prior to
calling it. (Note that s3c24xx_serial_start_tx() is only invoked by the
serial core).

However, s3c24xx_serial_rx_enable() and s3c24xx_serial_rx_disable()
unconditionally attempt to acquire port->lock again using
uart_port_lock_irqsave(). Since spinlocks are not recursive, this
causes a deadlock on the same CPU when console flow control is engaged.

Remove the redundant lock acquisition from both rx helper functions.
Published: 2026-07-25
Score: n/a
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A deadlock arises in the Samsung s3c24xx serial driver when console flow control is enabled. The driver’s stop_tx and start_tx callbacks, called with the port lock already held, invoke rx helpers that try to re‑acquire the same spinlock. Because spinlocks are not recursive, this re‑acquisition blocks the CPU, halting the kernel and denying all services that rely on the serial console.

Affected Systems

Vendors: Linux kernel incorporating the Samsung s3c24xx serial driver. The vulnerability applies to any build that includes this driver component; specific version numbers are not listed in the data, so it is inferred that all unpatched kernels using the driver are affected. Only the Samsung serial driver is impacted—other serial drivers or non‑Samsung hardware are not affected.

Risk and Exploitability

The EPSS score of < 1% indicates a very low probability that this flaw will be exploited in the wild, and it has not been recorded in the CISA KEV catalog. Exploitation requires the system to have console flow control active, meaning local or privileged access is needed. If achieved, the deadlock would stall the kernel, potentially requiring a reboot or patch, but no current evidence of active attacks exists.

Generated by OpenCVE AI on August 2, 2026 at 12:10 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Linux kernel release that includes the fixed driver code.
  • If an immediate kernel update is not possible, disable console flow control (UPF_CONS_FLOW) for the s3c24xx serial driver to prevent the deadlock.
  • Monitor system logs for kernel panic or serial port stalls and reboot or update the kernel when an official patch becomes available.

Generated by OpenCVE AI on August 2, 2026 at 12:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Ubuntu USN Ubuntu USN USN-8618-1 Linux kernel vulnerabilities
History

Thu, 30 Jul 2026 12:15:00 +0000


Sat, 25 Jul 2026 10:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: tty: serial: samsung: Remove redundant port lock acquisition in rx helpers Sashiko identified a deadlock when the console flow is engaged [1]. When console flow control is enabled (UPF_CONS_FLOW), s3c24xx_serial_stop_tx() calls s3c24xx_serial_rx_enable() and s3c24xx_serial_start_tx() calls s3c24xx_serial_rx_disable(). The serial core framework invokes the .stop_tx() and .start_tx() callbacks with the port->lock spinlock already held. Furthermore, all internal driver paths that invoke stop_tx (such as the DMA TX completion handler s3c24xx_serial_tx_dma_complete() or the PIO TX IRQ handler s3c24xx_serial_tx_irq()) also acquire port->lock prior to calling it. (Note that s3c24xx_serial_start_tx() is only invoked by the serial core). However, s3c24xx_serial_rx_enable() and s3c24xx_serial_rx_disable() unconditionally attempt to acquire port->lock again using uart_port_lock_irqsave(). Since spinlocks are not recursive, this causes a deadlock on the same CPU when console flow control is engaged. Remove the redundant lock acquisition from both rx helper functions.
Title tty: serial: samsung: Remove redundant port lock acquisition in rx helpers
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-07-25T09:20:51.774Z

Reserved: 2026-07-19T15:36:31.794Z

Link: CVE-2026-64528

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-07-25T10:17:39.187

Modified: 2026-07-25T10:17:39.187

Link: CVE-2026-64528

cve-icon Redhat

Severity :

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64528 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T12:15:18Z

Weaknesses