In the Linux kernel, the following vulnerability has been resolved: serial: 8250_dma: Clear stale RX state on shutdown serial8250_release_dma()… (CVE-2026-74654)
A vulnerability in the Linux kernel's serial 8250_dma driver was resolved by clearing a stale RX state on shutdown. The issue occurs because the rx_running flag remains set after RX DMA termination, which can lead to a kernel Oops when reopening the port due to a NULL channel being passed to the DMAengine API. The fix clears the rx_running flag after terminating RX DMA and adds checks to prevent passing NULL channels during startup and teardown.
AI Analysis
Technical Summary
The Linux kernel's serial8250_release_dma() function terminates RX DMA and releases the channel but leaves the rx_running flag set. If the serial port is closed while an RX transfer is active, this stale state persists with a NULL rxchan until the channel is requested again. The DesignWare BUSY workaround calls serial8250_rx_dma_flush() during startup before a new RX channel is obtained. Because rx_running remains set, the flush path passes a NULL channel to dmaengine_pause(), causing a kernel Oops. The patch clears rx_running after RX DMA termination and ensures the flush helper returns early if the DMA object or RX channel is unavailable, preventing NULL channel usage in the DMAengine API.
Potential Impact
This vulnerability can cause a kernel Oops (crash) when reopening a serial port under certain conditions, potentially leading to denial of service on affected systems. No information about privilege escalation or data corruption is provided.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to clear the stale rx_running state after RX DMA termination and to prevent passing NULL channels to the DMAengine API. Users should apply the official kernel updates that include this patch. Patch status is not yet confirmed from vendor advisory; check the Linux kernel mailing lists or vendor advisories for the specific fixed versions and update accordingly.
In the Linux kernel, the following vulnerability has been resolved: serial: 8250_dma: Clear stale RX state on shutdown serial8250_release_dma()… (CVE-2026-74654)
Description
A vulnerability in the Linux kernel's serial 8250_dma driver was resolved by clearing a stale RX state on shutdown. The issue occurs because the rx_running flag remains set after RX DMA termination, which can lead to a kernel Oops when reopening the port due to a NULL channel being passed to the DMAengine API. The fix clears the rx_running flag after terminating RX DMA and adds checks to prevent passing NULL channels during startup and teardown.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's serial8250_release_dma() function terminates RX DMA and releases the channel but leaves the rx_running flag set. If the serial port is closed while an RX transfer is active, this stale state persists with a NULL rxchan until the channel is requested again. The DesignWare BUSY workaround calls serial8250_rx_dma_flush() during startup before a new RX channel is obtained. Because rx_running remains set, the flush path passes a NULL channel to dmaengine_pause(), causing a kernel Oops. The patch clears rx_running after RX DMA termination and ensures the flush helper returns early if the DMA object or RX channel is unavailable, preventing NULL channel usage in the DMAengine API.
Potential Impact
This vulnerability can cause a kernel Oops (crash) when reopening a serial port under certain conditions, potentially leading to denial of service on affected systems. No information about privilege escalation or data corruption is provided.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to clear the stale rx_running state after RX DMA termination and to prevent passing NULL channels to the DMAengine API. Users should apply the official kernel updates that include this patch. Patch status is not yet confirmed from vendor advisory; check the Linux kernel mailing lists or vendor advisories for the specific fixed versions and update accordingly.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-m9j6-hfqp-5v8v
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-74654"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a8a27f1acd9273b499bc7a0
Added to database: 08/22/2026, 22:51:29 UTC
Last enriched: 08/23/2026, 00:10:05 UTC
Last updated: 08/23/2026, 01:31:58 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.