CVE-2026-43061 Overview
CVE-2026-43061 is a deadlock vulnerability in the Linux kernel's 8250 serial driver when configured to use Direct Memory Access (DMA) for transmit operations. The flaw stems from improper handling of the dma->tx_running state flag after a terminated DMA transaction. When dmaengine_terminate_async cancels a transfer, the __dma_tx_complete callback, which is the only code path that clears dma->tx_running, may never execute. This leaves the flag permanently set and prevents the driver from scheduling any further TX DMA transactions.
Critical Impact
Serial console output and TX traffic over 8250-compatible UART devices using DMA can stall indefinitely, blocking communication and potentially affecting system management interfaces that depend on serial connectivity.
Affected Products
- Linux kernel serial: 8250 driver with DMA enabled
- Stable kernel branches receiving the fixes referenced in commits 2a72403, 5f6b175, 79a19bd, 8190f9a, a424a34, b5ad887, d2719a0, and f76d912
- Systems and embedded platforms relying on 8250-compatible UART hardware with DMA acceleration
Discovery Timeline
- 2026-05-05 - CVE-2026-43061 published to NVD
- 2026-05-06 - Last updated in NVD database
Technical Details for CVE-2026-43061
Vulnerability Analysis
The 8250 serial driver supports DMA-accelerated transmit paths. The driver tracks whether a TX DMA transaction is in flight using the dma->tx_running flag. The flag is set when a transaction is queued and cleared inside the __dma_tx_complete callback once the transfer finishes.
The issue arises when serial8250_tx_dma_flush calls dmaengine_terminate_async to cancel an in-flight transfer. The DMA engine API does not guarantee that the completion callback will run after termination. If the callback is skipped, dma->tx_running remains set forever. The driver then refuses to queue new TX DMA transactions, producing a persistent TX deadlock on that UART port.
The kernel patch clears dma->tx_running directly after termination. The change is safe because serial8250_tx_dma_flush holds the UART port lock, and the callback also acquires the same lock as its first action. Lock ownership serializes access to the flag and prevents a race between the termination path and a late callback.
Root Cause
The root cause is a state-tracking flaw, classifiable as a deadlock condition. The driver assumed __dma_tx_complete would always run, but dmaengine_terminate_async semantics make that assumption invalid. The single point of state mutation became unreachable under termination, leaving the TX path permanently disabled.
Attack Vector
No remote attack vector is documented. The condition is triggered by legitimate driver behavior during DMA termination, typically under port flush, shutdown, or error recovery sequences. Impact is local denial of service against the serial transmit path. No memory corruption or privilege boundary crossing has been associated with this CVE.
Detection Methods for CVE-2026-43061
Indicators of Compromise
- Serial console output stops transmitting while the receive path continues to function on an 8250-compatible UART configured for DMA.
- Kernel logs show a TX flush or DMA terminate event followed by absence of further __dma_tx_complete callbacks for the affected port.
- Userspace processes writing to /dev/ttyS* block on write or report TX buffer never draining.
Detection Strategies
- Audit kernel versions across the fleet and compare against the patched stable releases referenced by the upstream commits.
- Monitor for hung serial-dependent services such as out-of-band management agents, industrial control loops, or remote console relays.
- Correlate kernel ring buffer events around serial8250_tx_dma_flush with subsequent UART silence to identify reproductions of the deadlock.
Monitoring Recommendations
- Track uname -r and kernel package versions in configuration management to confirm patch deployment.
- Add health checks that periodically write to and read from monitored serial endpoints to detect unidirectional stalls.
- Forward kernel logs to a centralized log platform and alert on repeated DMA terminate events without matching completion callbacks.
How to Mitigate CVE-2026-43061
Immediate Actions Required
- Identify hosts running affected kernel versions that use the 8250 driver with DMA enabled, particularly embedded systems and servers using BMC or industrial serial links.
- Apply the upstream stable kernel update containing the fix that clears dma->tx_running after dmaengine_terminate_async.
- Reboot patched systems to load the corrected kernel and verify serial TX functionality after the update.
Patch Information
The fix is available in the Linux stable tree across multiple maintained branches. Reference commits include Linux Kernel Patch 2a72403, Linux Kernel Patch 5f6b175, Linux Kernel Patch 79a19bd, Linux Kernel Patch 8190f9a, Linux Kernel Patch a424a34, Linux Kernel Patch b5ad887, Linux Kernel Patch d2719a0, and Linux Kernel Patch f76d912. Pull the version aligned with your stable branch.
Workarounds
- Disable DMA for the affected 8250 ports by passing 8250.nr_uarts and platform-specific options that fall back to programmed I/O until the patched kernel is deployed.
- Avoid invoking explicit serial port flush operations that can trigger dmaengine_terminate_async on unpatched systems running production workloads.
- Schedule a serial port reset or driver module reload as a recovery step if a TX deadlock is observed before patching is complete.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
