CVE-2026-74654 - Vulnerability Details

- serial: 8250_dma: Clear stale RX state on shutdown

Description

In the Linux kernel, the following vulnerability has been resolved:

serial: 8250_dma: Clear stale RX state on shutdown

serial8250_release_dma() terminates RX DMA and releases the channel, but
leaves rx_running set. If the port is closed while an RX transfer is
active, the stale state remains while rxchan is NULL until the channel is
requested again on the next open.

The DesignWare BUSY workaround added by commit a7b9ce39fbe4
("serial: 8250_dw: Ensure BUSY is deasserted") calls
serial8250_rx_dma_flush() from the LCR write path during startup. This
happens before serial8250_request_dma() obtains a new RX channel. On
reopen, the stale rx_running state therefore makes the flush path pass a
NULL channel to dmaengine_pause(), causing a kernel Oops.

Clear rx_running after terminating RX DMA, matching the TX cleanup. Also
make the flush helper return if the DMA object or RX channel is not
available so startup and teardown paths cannot pass a NULL channel to the
DMAengine API.

Published: 2026-08-22

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel's serial8250 driver, a stale receive state may remain after an RX DMA transfer is terminated. When a serial port is closed while the RX DMA is still active, the driver leaves the rx_running flag set and subsequently passes a NULL channel to the DMA engine, causing a kernel Oops. This failure results in a kernel crash and can disrupt system availability. The weakness involved is a null pointer dereference, which corresponds to CWE‑476.

Affected Systems

All Linux kernel versions that compile with the serial8250 DMA driver before the documented fix are affected. The vendor is the Linux Kernel, but no explicit version range is listed in the CVE data.

Risk and Exploitability

The CVE description confirms a kernel crash, which is a local denial of service effect. The CVSS score of 5.5 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation, and the vulnerability is not listed in CISA KEV. The attack vector and required privileges are not specified, so it remains unclear whether the issue can be triggered without local or privileged access.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`0fcb7901f9d61a325b4c5b88c600383bcbeb97fe`	affected	< bf4fb620e02962b2b52500a4b3d8420f351eb46a
`0fcb7901f9d61a325b4c5b88c600383bcbeb97fe`	affected	< e10f06ee050a08930e2339b6fec7148fd0b2a8f6
`0fcb7901f9d61a325b4c5b88c600383bcbeb97fe`	affected	< d06cfb1add4a2d5b393e9e31f49ebbd168beea49
`0fcb7901f9d61a325b4c5b88c600383bcbeb97fe`	affected	< e7a5d792cf64a2096e18f1d573cc3d01cba15e92
`0fcb7901f9d61a325b4c5b88c600383bcbeb97fe`	affected	< 9f2444f4c0e4b06f61bae38da87c9c94c78efa86
`0fcb7901f9d61a325b4c5b88c600383bcbeb97fe`	affected	< ae05d9e50b6b9f246c110b3bdc03676145c2d0d4
`0fcb7901f9d61a325b4c5b88c600383bcbeb97fe`	affected	< e7e3cc6709caa49d1d6ce6c1f7cb305e38675cc9
`0fcb7901f9d61a325b4c5b88c600383bcbeb97fe`	affected	< e2fe6a0efecbef00e3ecc2db64dd5afa8c212b41

Linux

affected

Version	Status	Constraints
`3.19`	affected	—
`0`	unaffected	< 3.19
`5.10.265`	unaffected	≤ 5.10.*
`5.15.216`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.152`	unaffected	≤ 6.6.*
`6.12.104`	unaffected	≤ 6.12.*
`6.18.45`	unaffected	≤ 6.18.*
`7.1.9`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[0fcb7901f9d61a325b4c5b88c600383bcbeb97fe,bf4fb620e02962b2b52500a4b3d8420f351eb46a)`	affected	code_commit	—
`[0fcb7901f9d61a325b4c5b88c600383bcbeb97fe,e10f06ee050a08930e2339b6fec7148fd0b2a8f6)`	affected	code_commit	—
`[0fcb7901f9d61a325b4c5b88c600383bcbeb97fe,d06cfb1add4a2d5b393e9e31f49ebbd168beea49)`	affected	code_commit	—
`[0fcb7901f9d61a325b4c5b88c600383bcbeb97fe,e7a5d792cf64a2096e18f1d573cc3d01cba15e92)`	affected	code_commit	—
`[0fcb7901f9d61a325b4c5b88c600383bcbeb97fe,9f2444f4c0e4b06f61bae38da87c9c94c78efa86)`	affected	code_commit	—
`[0fcb7901f9d61a325b4c5b88c600383bcbeb97fe,ae05d9e50b6b9f246c110b3bdc03676145c2d0d4)`	affected	code_commit	—
`[0fcb7901f9d61a325b4c5b88c600383bcbeb97fe,e7e3cc6709caa49d1d6ce6c1f7cb305e38675cc9)`	affected	code_commit	—
`[0fcb7901f9d61a325b4c5b88c600383bcbeb97fe,e2fe6a0efecbef00e3ecc2db64dd5afa8c212b41)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.19`	affected	generic	—
`[0,3.19)`	unaffected	generic	—
`[5.10.265,5.11.0)`	unaffected	semver	—
`[5.15.216,5.16.0)`	unaffected	semver	—
`[6.1.183,6.2.0)`	unaffected	semver	—
`[6.6.152,6.7.0)`	unaffected	semver	—
`[6.12.104,6.13.0)`	unaffected	semver	—
`[7.1.9,7.2.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—
`[6.18.45,6.19.0)`	unaffected	semver	—
`[6.12.104,6.13.0)`	unaffected	semver	—
`[6.6.152,6.7.0)`	unaffected	semver	—
`[6.1.183,6.2.0)`	unaffected	semver	—
`[5.15.216,5.16.0)`	unaffected	semver	—
`[5.10.265,5.11.0)`	unaffected	semver	—
`[0,3.19)`	unaffected	generic	—
`3.19`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the serial8250 DMA shutdown fix
If an upgrade cannot be applied immediately, disable serial8250 DMA support or configure the serial driver to use a non‑DMA controller
Ensure that any application closing a serial port verifies that no active DMA transfer is pending before performing the close operation

Generated by OpenCVE AI on August 24, 2026 at 13:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4777-1	linux security update
Debian DSA	DSA-6466-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00177.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/9f2444f4c0e4b06f61bae38da87c9c94c78efa86
https://git.kernel.org/stable/c/ae05d9e50b6b9f246c110b3bdc03676145c2d0d4
https://git.kernel.org/stable/c/bf4fb620e02962b2b52500a4b3d8420f351eb46a
https://git.kernel.org/stable/c/d06cfb1add4a2d5b393e9e31f49ebbd168beea49
https://git.kernel.org/stable/c/e10f06ee050a08930e2339b6fec7148fd0b2a8f6
https://git.kernel.org/stable/c/e2fe6a0efecbef00e3ecc2db64dd5afa8c212b41
https://git.kernel.org/stable/c/e7a5d792cf64a2096e18f1d573cc3d01cba15e92
https://git.kernel.org/stable/c/e7e3cc6709caa49d1d6ce6c1f7cb305e38675cc9
https://lore.kernel.org/linux-cve-announce/2026082226-CVE-2026-74654-5975@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74654
https://www.cve.org/CVERecord?id=CVE-2026-74654

History

Mon, 24 Aug 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://lore.kernel.org/linux-cve-announce/2026082226-CVE-2026-74654-5975@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74654 https://www.cve.org/CVERecord?id=CVE-2026-74654
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Sat, 22 Aug 2026 15:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: serial: 8250_dma: Clear stale RX state on shutdown serial8250_release_dma() terminates RX DMA and releases the channel, but leaves rx_running set. If the port is closed while an RX transfer is active, the stale state remains while rxchan is NULL until the channel is requested again on the next open. The DesignWare BUSY workaround added by commit a7b9ce39fbe4 ("serial: 8250_dw: Ensure BUSY is deasserted") calls serial8250_rx_dma_flush() from the LCR write path during startup. This happens before serial8250_request_dma() obtains a new RX channel. On reopen, the stale rx_running state therefore makes the flush path pass a NULL channel to dmaengine_pause(), causing a kernel Oops. Clear rx_running after terminating RX DMA, matching the TX cleanup. Also make the flush helper return if the DMA object or RX channel is not available so startup and teardown paths cannot pass a NULL channel to the DMAengine API.
Title		serial: 8250_dma: Clear stale RX state on shutdown
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/9f2444f4c0e4b06f61bae38da87c9c94c78efa86 https://git.kernel.org/stable/c/ae05d9e50b6b9f246c110b3bdc03676145c2d0d4 https://git.kernel.org/stable/c/bf4fb620e02962b2b52500a4b3d8420f351eb46a https://git.kernel.org/stable/c/d06cfb1add4a2d5b393e9e31f49ebbd168beea49 https://git.kernel.org/stable/c/e10f06ee050a08930e2339b6fec7148fd0b2a8f6 https://git.kernel.org/stable/c/e2fe6a0efecbef00e3ecc2db64dd5afa8c212b41 https://git.kernel.org/stable/c/e7a5d792cf64a2096e18f1d573cc3d01cba15e92 https://git.kernel.org/stable/c/e7e3cc6709caa49d1d6ce6c1f7cb305e38675cc9

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-22T15:32:29.263Z

Updated: 2026-08-22T15:32:29.263Z

Reserved: 2026-08-15T05:44:03.923Z

Link: CVE-2026-74654

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-22T16:16:38.937

Modified: 2026-08-22T16:16:38.937

Link: CVE-2026-74654

Redhat

Severity : Low

Publid Date: 2026-08-22T00:00:00Z

Links: CVE-2026-74654 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-24T13:45:04Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object