CVE-2026-74655: Linux Kernel UART TX DMA DoS Vulnerability

CVE-2026-74655 Overview

CVE-2026-74655 is a Linux kernel vulnerability in the qcom-geni serial driver used on Qualcomm SoCs. The flaw affects TX DMA (Direct Memory Access) buffer flush handling in the UART (Universal Asynchronous Receiver-Transmitter) driver. When userspace flushes the transmit path during an ongoing TX DMA, the UART becomes stuck infinitely repeating corrupted TX DMA frames. A local user can trigger the condition with a large write() followed by a TCOFLUSH ioctl, after which a subsequent tcdrain() hangs forever. The bug was reproduced on Arduino Uno Q (QRB2210) using /dev/ttyHS1.

Critical Impact
A local unprivileged user with access to an affected UART device can cause a kernel-side hang and corrupt serial output on Qualcomm-based Linux systems.

Affected Products

Linux kernel builds including the drivers/tty/serial/qcom_geni_serial.c driver
Qualcomm SoC platforms exposing GENI UARTs (for example, QRB2210 as used in Arduino Uno Q)
Downstream distributions and embedded/IoT images shipping the vulnerable driver prior to the fix

Discovery Timeline

2026-08-22 - CVE-2026-74655 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-74655

Vulnerability Analysis

The vulnerability resides in the DMA-mode uart_ops implementation of the qcom-geni serial driver. The driver did not provide a flush_buffer callback for DMA mode. When the serial core resets the transmit kfifo in response to a flush, an in-flight DMA transfer can still complete afterwards. That late completion underflows the fifo length counter and causes the driver to resubmit page-sized transfers indefinitely, producing an infinite stream of corrupted frames on the UART line.

The stop path was also unsound. The driver unmapped the DMA buffer while the serial engine could still be reading from it, and it never reset the TX DMA state machine. A pending mapping was additionally leaked when the main sequencer command was inactive due to an early return in the cleanup path. The fix adds a proper flush_buffer op that stops the transfer and clears tx_remaining and tx_queued, cancels the main sequencer command before resetting the TX DMA state machine, waits for the reset, and only then unmaps the buffer.

Root Cause

The root cause is a race condition and missing synchronization between the serial core's transmit flush path and the qcom-geni DMA engine. A missing flush_buffer callback combined with an unsafe stop sequence allows in-flight DMA to complete against a reset fifo, producing kernel state corruption in the transmit path.

Attack Vector

Exploitation requires local access with permission to open the affected UART character device, typically /dev/ttyHS*. An attacker issues a large write() on the device followed immediately by a TCOFLUSH via tcflush(). Any subsequent tcdrain() on the device hangs indefinitely, and the UART emits corrupted frames continuously until the system is reset.

No verified proof-of-concept code is published beyond the reproduction description in the upstream commit message. See the kernel commit b1801c0 for the authoritative fix and reproduction notes.

Detection Methods for CVE-2026-74655

Indicators of Compromise

Processes stuck in uninterruptible sleep (D state) on tcdrain() or close() against /dev/ttyHS* devices
Continuous, repeating corrupted output observed on a Qualcomm GENI-backed UART line
Kernel soft-lockup or hung task warnings referencing qcom_geni_serial functions in dmesg

Detection Strategies

Inventory Linux systems running Qualcomm SoCs and confirm kernel version against the fixed stable trees referenced in the upstream commits.
Monitor kernel logs for hung_task warnings and stack traces containing qcom_geni_serial_* symbols.
Audit which local user accounts and services have read/write access to /dev/ttyHS* nodes, since local access is required.

Monitoring Recommendations

Forward dmesg and journalctl -k output to a centralized logging or SIEM pipeline for kernel warning correlation.
Alert on repeated tcdrain or ioctl(TCFLSH) failures and on processes remaining in D state on tty devices for extended periods.
Track package and kernel update status across Qualcomm-based fleets to confirm patch rollout.

How to Mitigate CVE-2026-74655

Immediate Actions Required

Update to a Linux kernel that includes the upstream fix for qcom-geni TX DMA buffer flush from the stable branches referenced by the linked commits.
Restrict access to /dev/ttyHS* device nodes to trusted users and services using group ownership and file permissions.
Reboot affected devices after patching to ensure the corrected driver replaces any loaded vulnerable version.

Patch Information

The fix is available in the upstream Linux kernel through the following stable commits: Kernel Commit 1606abb, Kernel Commit 1c31e23, Kernel Commit 313ae28, Kernel Commit b1801c0, and Kernel Commit e3c0483. Downstream distributions and vendor BSPs should be updated as those backports become available.

Workarounds

Limit UART device permissions so that only privileged system components can open affected /dev/ttyHS* nodes.
Where possible, disable DMA mode on the affected UART or unbind the qcom_geni_serial driver on ports that are not required.
Avoid running untrusted local code on Qualcomm-based devices that expose GENI UARTs to unprivileged users until the patched kernel is deployed.

bash

# Example: restrict access to Qualcomm GENI UART devices
sudo chgrp dialout /dev/ttyHS*
sudo chmod 0660 /dev/ttyHS*

# Verify running kernel after patching
uname -r