The Linux kernel's qcom_geni serial driver had a race condition triggered when uart_flush_buffer() was called before the DMA completion IRQ. This caused the kfifo buffer to be reset while tx_remaining still indicated data pending transmission. When the DMA IRQ fired, uart_xmit_advance() incorrectly incremented the kfifo output pointer, wrapping it past the input pointer and causing kfifo_len() to return an incorrect length. Consequently, stale data could be retransmitted in subsequent DMA transfers. The patch fixes this by snapshotting the kfifo length at the start of the DMA handler and skipping uart_xmit_advance() if the fifo length is less than tx_remaining, indicating a reset occurred.

The vulnerability could cause stale buffer data to be retransmitted over the serial interface, potentially leading to data corruption or unexpected behavior in systems relying on the Qualcomm GENI serial driver. There is no indication of remote code execution or privilege escalation. No known exploits are reported in the wild.

A fix has been implemented in the Linux kernel to address this race condition by modifying the DMA completion handler logic. Users should update to a Linux kernel version that includes this fix once available. Since this is a kernel-level issue, applying the official kernel patch or upgrading to a fixed kernel release is the recommended remediation. Patch status is not explicitly confirmed in the provided data; check the vendor or Linux kernel advisories for the exact fixed versions and patch availability.