CVE-2026-64234: Linux Kernel PCH UART DMA Vulnerability

CVE-2026-64234 Overview

CVE-2026-64234 is a null pointer dereference vulnerability in the Linux kernel's pch_uart serial driver. The flaw exists in the dma_handle_rx() function within drivers/tty/serial/pch_uart.c, where the driver failed to check the return value of dma_alloc_coherent() before use. When the coherent DMA allocation fails, the driver dereferences a null pointer, leading to a kernel crash.

The upstream fix adds the missing return-value check and introduces a goto ladder that properly releases DMA channels and the PCI device reference on the allocation-failure path.

Critical Impact
Local triggering of the DMA allocation failure path can cause a kernel null pointer dereference in the pch_uart driver, resulting in a denial of service on affected Linux systems.

Affected Products

Linux kernel (multiple stable branches) — drivers/tty/serial/pch_uart.c
Systems using the Intel Platform Controller Hub (PCH) UART hardware served by the pch_uart driver
Distributions shipping kernels prior to the fix commits referenced in the kernel.org stable tree

Discovery Timeline

2026-07-24 - CVE-2026-64234 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64234

Vulnerability Analysis

The pch_uart driver provides serial console support for Intel PCH UART hardware. During receive-side DMA setup, the driver calls dma_alloc_coherent() to obtain a coherent memory buffer for incoming data. The unpatched code used the returned pointer without verifying success.

When dma_alloc_coherent() returns NULL — for example, under memory pressure or DMA-mapping constraints — the subsequent access inside dma_handle_rx() dereferences a null pointer. This triggers a kernel oops and destabilizes the affected CPU context.

The issue is a reliability and denial-of-service flaw local to the driver's initialization and receive path. It does not, on its own, provide a primitive for arbitrary code execution or privilege escalation.

Root Cause

The root cause is missing error handling on an allocation call. The driver assumed dma_alloc_coherent() would always succeed and passed the result directly into consumer logic. The fix introduces an explicit NULL check and a goto cleanup ladder that unwinds prior allocations — releasing the previously requested DMA channels and dropping the acquired PCI device reference — before returning an error.

Attack Vector

Triggering the failure path requires the pch_uart driver to be loaded and active on hardware that exposes the PCH UART. A local condition that causes coherent DMA allocation to fail — sustained memory pressure or exhaustion of DMA-capable memory — can drive the code into the vulnerable branch. Remote exploitation is not indicated by the available data.

No public proof-of-concept exploit is referenced in the CVE data, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

// No verified exploit code is available for CVE-2026-64234.
// See the kernel.org stable commits referenced below for the patch diff
// showing the added dma_alloc_coherent() NULL check and cleanup ladder.

Detection Methods for CVE-2026-64234

Indicators of Compromise

Kernel oops or panic messages referencing dma_handle_rx or pch_uart in dmesg and /var/log/kern.log.
Unexpected serial port service failures on systems using the Intel PCH UART controller.
Stack traces implicating drivers/tty/serial/pch_uart.c following memory-pressure events.

Detection Strategies

Inventory running kernel versions across Linux fleet assets and compare against the fixed commits in the kernel.org stable tree (5f2e2a240d, 66f8bfea05, 6dd5c0ea13, 6fe472c1bb, 760df81763, d846df2dfb, d8d53a343e, daea997bb2).
Check whether the pch_uart module is loaded using lsmod | grep pch_uart to scope exposure to hardware that actually uses the driver.
Correlate kernel crash telemetry with recent memory-pressure or OOM events to identify systems entering the vulnerable failure path.

Monitoring Recommendations

Forward dmesg and kernel ring buffer output to a central log store and alert on NULL pointer dereference entries referencing serial or DMA subsystems.
Monitor host availability and unexpected reboots on systems where pch_uart is the console or management serial path.
Track memory pressure metrics on affected hosts so operators can correlate resource exhaustion with driver crashes.

How to Mitigate CVE-2026-64234

Immediate Actions Required

Apply the stable-tree kernel update containing the pch_uart fix from your distribution vendor as soon as it is available.
On systems that do not require the pch_uart driver, unload the module with modprobe -r pch_uart and blacklist it to eliminate exposure.
Prioritize patching hosts that rely on the PCH UART for out-of-band console access, since a crash there also impacts recoverability.

Patch Information

The fix is present in the following Linux kernel stable commits: 5f2e2a240d, 66f8bfea05, 6dd5c0ea13, 6fe472c1bb, 760df81763, d846df2dfb, d8d53a343e, and daea997bb2. Rebuild or update to a distribution kernel package that incorporates one of these commits for your kernel branch.

Workarounds

Blacklist the pch_uart module on systems where PCH UART functionality is not required.
Reduce sustained memory pressure on affected hosts so dma_alloc_coherent() is less likely to fail while a patched kernel is being rolled out.
Ensure kernel crash dumps (kdump) are configured to preserve forensic evidence if the failure path is hit before patching completes.

bash

# Blacklist the pch_uart driver where it is not required
echo "blacklist pch_uart" | sudo tee /etc/modprobe.d/blacklist-pch_uart.conf
sudo modprobe -r pch_uart

# Verify the module is no longer loaded
lsmod | grep pch_uart

# After applying a patched kernel, confirm the running version
uname -r