CVE-2026-64528: Linux Kernel Race Condition Vulnerability

CVE-2026-64528 Overview

CVE-2026-64528 is a deadlock vulnerability in the Linux kernel's Samsung serial tty driver (drivers/tty/serial/samsung_tty.c). The flaw occurs when console flow control (UPF_CONS_FLOW) is enabled on Samsung S3C24xx-family UART hardware. The RX helper functions s3c24xx_serial_rx_enable() and s3c24xx_serial_rx_disable() attempt to re-acquire the port->lock spinlock that callers already hold, producing a non-recursive spinlock deadlock on the same CPU. The issue was identified by Sashiko and resolved by removing the redundant lock acquisition in both RX helpers.

Critical Impact
A deadlock in the serial console path can hang the affected CPU, blocking kernel logging and potentially rendering the system unresponsive on hardware using the Samsung serial driver with console flow control enabled.

Affected Products

Linux kernel tty/serial/samsung driver on systems using Samsung S3C24xx-family UART hardware
Kernel builds where console flow control (UPF_CONS_FLOW) is enabled on the Samsung serial port
Stable branches receiving the backported fixes referenced by the kernel.org commits

Discovery Timeline

Vulnerability identified by Sashiko (as credited in the upstream commit message)
2026-07-25 - CVE-2026-64528 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64528

Vulnerability Analysis

The Linux serial core invokes the .stop_tx() and .start_tx() UART operation callbacks with port->lock already held. In the Samsung driver, when UPF_CONS_FLOW is set, s3c24xx_serial_stop_tx() calls s3c24xx_serial_rx_enable() and s3c24xx_serial_start_tx() calls s3c24xx_serial_rx_disable(). Both RX helpers then call uart_port_lock_irqsave() on the same port->lock. Because kernel spinlocks are not recursive, the second acquisition on the same CPU deadlocks execution.

Internal driver paths reach the same condition. The DMA TX completion handler s3c24xx_serial_tx_dma_complete() and the PIO TX interrupt handler s3c24xx_serial_tx_irq() both acquire port->lock before calling stop_tx, guaranteeing the lock is held when the RX helpers execute. This is a locking design defect classified as a kernel concurrency flaw ([CWE-667] Improper Locking).

Root Cause

The RX helper functions were written to be self-contained and always take port->lock, without accounting for callers that already hold it. Combined with the console flow control code path that cross-invokes RX enable/disable from within TX callbacks, this violates the driver's locking contract with the serial core.

Attack Vector

The deadlock triggers on ordinary serial console I/O when flow control is engaged. No network exposure or unprivileged user action is required, and there is no indication of remote exploitability. The practical impact is a local denial of service on affected hardware. See the upstream fix commits, for example kernel.org commit 14143ec1 and kernel.org commit a9c22e0f, for the code-level change that removes the redundant uart_port_lock_irqsave() calls from both RX helpers.

Detection Methods for CVE-2026-64528

Indicators of Compromise

Kernel soft-lockup or hard-lockup warnings referencing s3c24xx_serial_rx_enable or s3c24xx_serial_rx_disable in the backtrace.
lockdep splats reporting recursive acquisition of port->lock in the samsung_tty driver.
Serial console becoming unresponsive shortly after flow control activity on Samsung S3C UART hardware.

Detection Strategies

Enable CONFIG_PROVE_LOCKING and CONFIG_DEBUG_SPINLOCK on test kernels to surface the double-acquire condition before production deployment.
Inventory kernels built with the Samsung serial driver and check whether UPF_CONS_FLOW is set on any registered UART port.
Compare the running kernel's samsung_tty.c against the fixed commits listed in the NVD references to confirm the patch is present.

Monitoring Recommendations

Forward dmesg and /var/log/kern.log to a central log store and alert on BUG: spinlock or watchdog: BUG: soft lockup entries from tty subsystems.
Track kernel version and patch level across embedded and IoT fleets that use Samsung SoCs to identify unpatched hosts.
Monitor serial console availability on management hosts; sudden loss of console output is a practical signal of this deadlock.

How to Mitigate CVE-2026-64528

Immediate Actions Required

Update to a Linux kernel version that includes the upstream fix removing redundant port->lock acquisition from s3c24xx_serial_rx_enable() and s3c24xx_serial_rx_disable().
For distribution kernels, apply the vendor-provided stable update that backports the referenced commits.
Where patching is delayed, disable console flow control on Samsung serial ports to avoid the deadlock path.

Patch Information

The fix is available in the upstream Linux kernel stable tree across multiple branches. Relevant commits include kernel.org commit 10014eb7, kernel.org commit 14143ec1, kernel.org commit 9c92b422, kernel.org commit 9fd48937, kernel.org commit a3bb136b, kernel.org commit a9c22e0f, kernel.org commit ee9eb72b, and kernel.org commit f4c3e63f.

Workarounds

Remove the UPF_CONS_FLOW flag from the affected UART port configuration until the patch is applied.
Where feasible, route the kernel console to a non-Samsung serial port or a netconsole target to bypass the vulnerable code path.
Rebuild the kernel with the upstream patch cherry-picked into the vendor tree if a full stable-kernel upgrade is not immediately possible.

bash

# Verify the running kernel and installed samsung_tty source revision
uname -r
modinfo samsung_tty 2>/dev/null | grep -E 'filename|version|srcversion'

# Inspect UART port flags to check for console flow control
dmesg | grep -Ei 'samsung|s3c24xx|UPF_CONS_FLOW'