The Linux kernel qcom-geni serial driver had a flaw where flushing the transmit buffer during an ongoing TX DMA caused the UART to hang by infinitely repeating corrupted DMA frames. This was due to the lack of a flush_buffer callback in DMA-mode uart_ops, allowing in-flight transfers to complete after the transmit FIFO was reset, causing underflow and repeated resubmissions. Additionally, the stop path improperly unmapped buffers while still in use and failed to reset the TX DMA state machine. The fix involved adding a flush_buffer callback to stop transfers and clear internal counters, and correcting the stop sequence to cancel commands and reset the state machine before unmapping buffers. The issue was reproducible on Arduino Uno Q (QRB2210) using /dev/ttyHS1.

This vulnerability could cause the UART transmit path to hang indefinitely during certain flush operations, leading to a system hang or unresponsive serial communication. This affects systems using the qcom-geni UART driver when performing large writes followed by TCOFLUSH and tcdrain calls. There is no indication of privilege escalation or data corruption beyond the transmit hang.

A fix for this vulnerability has been implemented in the Linux kernel by adding a flush_buffer callback and correcting the stop path in the qcom-geni serial driver. Users should update to a Linux kernel version that includes this fix. No additional mitigations are specified or required beyond applying the official patch.