CVE-2026-80886: Linux Kernel MSM Serial Race Condition

CVE-2026-80886 Overview

CVE-2026-80886 is a race condition vulnerability in the Linux kernel's Qualcomm MSM serial (msm_serial) driver. Concurrent writes to the console UART from userspace and the kernel can trigger conflicting Direct Memory Access (DMA) and Programmed I/O (PIO) configurations. The result is an infinite loop of repeated messages being emitted to the console. The condition is most likely to surface during system startup or shutdown, when the init system starts or stops many services that write to the console simultaneously. The upstream fix disables DMA on the console UART instance to guarantee a reliable output path.

Critical Impact
Systems using the MSM serial driver as the kernel console can enter an infinite print loop, blocking boot, shutdown, or crash logging on affected Qualcomm-based Linux devices.

Affected Products

Linux kernel builds using the drivers/tty/serial/msm_serial.c driver as the kernel console
Qualcomm MSM/Snapdragon-based platforms running affected upstream kernel versions
Distributions shipping kernels prior to the stable backport commits referenced in the fix set

Discovery Timeline

2026-09-04 - CVE-2026-80886 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80886

Vulnerability Analysis

The vulnerability lives in the MSM serial driver's handling of concurrent writes to the TTY device that also serves as the kernel console. When a userspace process writes to the TTY, the driver initiates an asynchronous DMA transfer and then releases the port lock. During that window, the kernel printk path can acquire the port lock and reconfigure the UART controller for PIO mode without waiting for the outstanding DMA operation to complete.

This collision leaves the DMA engine reporting zero progress. The driver interprets the stalled state as unfinished work and retries, producing an infinite loop of the same buffered text on the serial console. Because the kernel console is expected to remain usable during crashes and low-level failures, the maintainers chose to disable DMA on the console UART entirely rather than layer additional synchronization between the two write paths. Similar guards already exist in other serial drivers such as 8250_port.c, imx.c, and sh-sci.c.

Root Cause

The root cause is a race condition (TOCTOU-class) between the userspace DMA write path and the kernel printk PIO write path in the MSM UART driver. The port lock is released before the DMA transfer completes, allowing the console write routine to reconfigure controller mode mid-transfer.

Attack Vector

The issue is a local reliability defect triggered by legitimate concurrent workloads rather than a remotely exploitable flaw. Any workload that produces heavy console output while userspace is also writing to the same TTY device can trigger the loop. This most commonly occurs during init system activity at boot or shutdown on Qualcomm-based hardware.

No verified public exploit code is available. Technical details are documented in the upstream fix commits, including Kernel Commit 22dd2777 and Kernel Commit f58e568d.

Detection Methods for CVE-2026-80886

Indicators of Compromise

Repeated identical lines flooding the serial console during boot, shutdown, or service restarts on MSM/Snapdragon platforms
System hangs or extended delays in systemd unit start/stop transitions with the console appearing stuck
Kernel log entries from msm_serial showing repeated DMA submissions without completion progress

Detection Strategies

Inventory Linux devices running Qualcomm MSM SoCs and confirm whether CONFIG_SERIAL_MSM_CONSOLE is enabled in the running kernel
Compare installed kernel versions against the stable branches that received the upstream fix commits listed in the NVD references
Review boot and shutdown console captures from lab and field devices for repeated message patterns indicative of the DMA/PIO race

Monitoring Recommendations

Collect serial console logs from affected fleets into a centralized log store and alert on high-frequency duplicate lines
Track kernel package versions across managed Linux endpoints and flag hosts still running pre-patch builds
Monitor boot-time and shutdown-time metrics for regressions that correlate with console flooding

How to Mitigate CVE-2026-80886

Immediate Actions Required

Update to a Linux kernel version that includes the upstream fix disabling DMA on the MSM console UART instance
Rebuild and redeploy custom or vendor kernels for Qualcomm-based devices with the stable backport applied
Validate boot, shutdown, and crash-console behavior on representative hardware after patching

Patch Information

The fix is distributed across multiple stable branches. Relevant commits include Kernel Commit 22dd2777, Kernel Commit 2727744c, Kernel Commit 6acea627, Kernel Commit abc1926c, Kernel Commit bb4296de, Kernel Commit d3547162, Kernel Commit e3b42e32, and Kernel Commit f58e568d. The change disables DMA for the UART instance registered as the kernel console.

Workarounds

Disable the MSM UART as the kernel console where operationally feasible by removing the console=ttyMSM* boot parameter
Reduce concurrent console traffic by lowering kernel log verbosity (loglevel= on the kernel command line) during boot and shutdown
Avoid userspace writers that stream large volumes of data to the console TTY on unpatched systems

bash

# Example: lower boot-time console verbosity on affected devices
# Append to the kernel command line in the bootloader configuration
loglevel=3 quiet