CVE-2026-74653 Overview
CVE-2026-74653 is a Linux kernel vulnerability in the 8250_of serial driver affecting NXP LPC32xx UART hardware (PORT_LPC3220). The device can latch an RX character-timeout interrupt while the RX FIFO is empty, producing an interrupt storm that livelocks the CPU. The Interrupt Identification Register (IIR) reports UART_IIR_RX_TIMEOUT (0x0c) while the Line Status Register (LSR) Data Ready bit is clear. Because serial8250_rx_chars() only reads the Receive Holding Register (RHR) when LSR.DR is set, the level-triggered interrupt is never acknowledged and re-fires immediately.
Critical Impact
Local unprivileged users on affected LPC32xx-based ARM926 systems can trigger a soft lockup by repeatedly opening ttyS1, causing a denial-of-service condition on the single-core CPU.
Affected Products
- Linux kernel 8250_of generic Open Firmware serial driver
- NXP LPC32xx UART hardware using PORT_LPC3220
- ARM926-based single-core platforms driving LPC32xx UARTs
Discovery Timeline
- 2026-08-22 - CVE-2026-74653 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-74653
Vulnerability Analysis
The defect is a hardware quirk that the generic 8250 interrupt handler does not accommodate. When the LPC32xx UART latches an RX character-timeout with an empty FIFO, the handler observes iir=0xcc, lsr=0x60, and ier=0x05, then loops without progress. Because the interrupt is level-triggered, the CPU cannot exit the interrupt service routine, which trips the soft-lockup detector in serial8250_handle_irq_locked().
The condition is reproducible from userspace. Repeatedly opening the front-panel port at ttyS1 causes serial8250_do_set_termios() to re-enable interrupts on unlock, after which the handler spins indefinitely. On single-core ARM926 systems, this constitutes a local denial-of-service against the entire kernel scheduler.
Root Cause
An RX character-timeout on this hardware is only cleared by reading RHR. The mainline serial8250_rx_chars() gate reads RHR only when LSR.DR is set, so the stuck empty-FIFO timeout is never acknowledged. LPC32xx has no dedicated 8250 glue driver and is handled by the generic 8250_of, which lacked hardware-specific timeout handling. The same class of bug was previously addressed in 8250_dw, 8250_omap (UART_RX_TIMEOUT_QUIRK), and 8250_bcm7271.
Attack Vector
A local user with permission to open the affected TTY device repeatedly opens ttyS1 and invokes termios operations. The resulting re-enable of interrupts triggers the level-triggered storm. No memory corruption or privilege escalation is involved; the outcome is CPU livelock and soft lockup on a single-core system.
See the referenced kernel commits for the technical fix, including commit 1423415471274 and commit c321dc5172c8.
Detection Methods for CVE-2026-74653
Indicators of Compromise
- Kernel soft-lockup warnings originating in serial8250_handle_irq_locked() on LPC32xx devices.
- Register state visible in kernel logs matching iir=0xcc, lsr=0x60, ier=0x05.
- Unresponsive console or system freeze correlating with userspace open/close activity on ttyS1.
Detection Strategies
- Monitor dmesg and syslog for BUG: soft lockup messages referencing 8250 IRQ handlers.
- Audit which processes hold or reopen /dev/ttyS1 on LPC32xx-based hardware.
- Verify running kernel version against the fixed stable releases referenced in the upstream commits.
Monitoring Recommendations
- Forward kernel logs from embedded LPC32xx devices to a centralized log store for lockup pattern searches.
- Track interrupt counters via /proc/interrupts for anomalous growth on the UART IRQ line.
- Alert on repeated device-open failures or watchdog resets on LPC32xx endpoints.
How to Mitigate CVE-2026-74653
Immediate Actions Required
- Update the Linux kernel on all LPC32xx-based systems to a stable release containing the 8250_of fix.
- Restrict permissions on /dev/ttyS1 so only trusted service accounts can open the port.
- Audit userspace applications that open the front-panel UART for unnecessary reopen loops.
Patch Information
The fix adds a hardware-specific handle_irq for PORT_LPC3220, wired up in of_platform_serial_setup() in the same manner as fsl8250_handle_irq. On an RX timeout with an empty FIFO (LSR.DR and LSR.BI clear), the handler performs one throwaway RHR read to clear the condition and then calls serial8250_handle_irq_locked(). No received data is discarded, and the handler is a no-op on healthy UARTs. See kernel commit 7795e8abedc8 and kernel commit 3ce24bc4d115.
Workarounds
- Disable the affected UART node in the device tree if the port is not required for operation.
- Prevent unprivileged users from accessing /dev/ttyS1 via udev rules and group permissions.
- Deploy watchdog-based recovery to reset devices that enter soft-lockup state until patched firmware is installed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
