CVE-2026-63883: Linux Kernel Race Condition Vulnerability

CVE-2026-63883 Overview

CVE-2026-63883 is a race condition in the Linux kernel qcom_geni serial driver. The flaw occurs when uart_flush_buffer() executes before a Direct Memory Access (DMA) completion interrupt is delivered. A subsequent call to uart_xmit_advance() on an already-reset kfifo causes the out index to wrap past in, producing an inflated kfifo_len(). The next start_tx_dma() invocation then transmits stale buffer contents from kernel memory. The issue affects Qualcomm GENI-based UART hardware on Linux systems and is fixed by snapshotting kfifo_len() at the start of handle_tx_dma() and skipping the advance when the fifo was reset.

Critical Impact
A local attacker with the ability to interact with a Qualcomm GENI serial port can trigger stale-memory transmission and integrity corruption on the UART transmit path.

Affected Products

Linux kernel builds including the drivers/tty/serial/qcom_geni_serial.c driver
Qualcomm GENI-based UART hardware platforms
Stable kernel branches referenced by commits 0d2c41a8, 452d6fa3, 654f45a8, b1159dce, and c91ea133

Discovery Timeline

2026-07-19 - CVE-2026-63883 published to the National Vulnerability Database
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63883

Vulnerability Analysis

The vulnerability is a race condition (TOCTOU-class) on the UART transmit path in the qcom_geni serial driver. All steps run under uart_port_lock, but the DMA completion interrupt can arrive after a flush has already reset the kfifo state. The driver assumes tx_remaining bytes are still present in the kfifo when the DMA interrupt handler runs, which no longer holds after a flush. The result is a mismatch between the driver's accounting and the actual kfifo contents.

Root Cause

The root cause is missing synchronization between uart_flush_buffer() and the deferred DMA completion handler handle_tx_dma(). The sequence unfolds as follows: DMA starts with tx_remaining = N and the kfifo containing N bytes. The hardware completes the DMA and raises an interrupt that is not yet serviced. uart_flush_buffer() acquires the port lock, calls kfifo_reset() (setting in and out to zero), and releases the lock. The pending DMA IRQ then fires and invokes uart_xmit_advance(uport, tx_remaining), which increments kfifo->out by tx_remaining. Because out now exceeds in, kfifo_len() returns UART_XMIT_SIZE - tx_remaining instead of zero.

Attack Vector

Exploitation requires local access with permissions to open and drive the affected TTY device. A local user issues a workload that triggers a DMA transmit followed by an operation causing uart_flush_buffer() (for example, closing the port or issuing TCFLSH) while a DMA completion is in flight. The subsequent start_tx_dma() submits UART_XMIT_SIZE - tx_remaining bytes of stale kernel buffer data over the serial link. This produces data integrity corruption on the UART output and can leak previously buffered kernel memory contents to any consumer of the serial line.

No verified public exploit code is available. The upstream fix records the correction in the commits linked in the references section.

Detection Methods for CVE-2026-63883

Indicators of Compromise

Unexpected garbled or repeated data emitted on Qualcomm GENI UART consoles after TCFLSH or port close operations
Kernel log anomalies from qcom_geni_serial indicating oversized transmit lengths following a flush
Serial-attached peripherals receiving stale frames that do not match any application-level write

Detection Strategies

Compare running kernel version and qcom_geni_serial.c commit against the fixed commits 0d2c41a8, 452d6fa3, 654f45a8, b1159dce, and c91ea133
Enable ftrace on handle_tx_dma, uart_xmit_advance, and uart_flush_buffer on affected devices to catch interleavings where flush precedes DMA completion
Monitor local privilege boundaries around /dev/tty* nodes bound to GENI hardware and flag processes issuing rapid open/write/flush cycles

Monitoring Recommendations

Ingest kernel logs into a centralized store and alert on qcom_geni warnings, DMA completion errors, and kfifo state anomalies
Track kernel package versions across the fleet and flag hosts running unpatched stable branches
Audit access to serial devices, including udev rules and group membership for dialout or equivalent on affected platforms

How to Mitigate CVE-2026-63883

Immediate Actions Required

Update Linux kernels on Qualcomm GENI-based platforms to a stable release containing the referenced fix commits
Inventory devices exposing GENI UARTs and restrict access to trusted local users and services only
Rebuild and redeploy any custom kernels that carry a backport of qcom_geni_serial.c without the fix

Patch Information

The fix snapshots kfifo_len() at the start of handle_tx_dma() and skips uart_xmit_advance() when fifo_len < tx_remaining, which indicates the kfifo was reset by a preceding flush. The patch is available in the following upstream commits: Kernel Git Commit 0d2c41a8, Kernel Git Commit 452d6fa3, Kernel Git Commit 654f45a8, Kernel Git Commit b1159dce, and Kernel Git Commit c91ea133.

Workarounds

Restrict permissions on affected TTY device nodes so only trusted service accounts can perform flush operations
Where feasible on non-critical systems, disable DMA mode for the qcom_geni UART and force PIO to remove the race window
Avoid workloads that rapidly interleave write() and TCFLSH on GENI serial ports until the patched kernel is deployed

bash

# Verify the running kernel and confirm the qcom_geni_serial fix is present
uname -r
zgrep -i 'qcom_geni\|CONFIG_SERIAL_QCOM_GENI' /proc/config.gz 2>/dev/null || \
  grep -i 'qcom_geni\|CONFIG_SERIAL_QCOM_GENI' /boot/config-$(uname -r)

# Tighten access to Qualcomm GENI TTY devices
ls -l /dev/ttyMSM* /dev/ttyHS* 2>/dev/null
chmod 0660 /dev/ttyMSM* /dev/ttyHS* 2>/dev/null