CVE-2026-64528

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: tty: serial: samsung: Remove redundant port lock acquisition in rx helpers Sashiko identified a deadlock when the console flow is engaged [1]. When console flow control is enabled (UPF_CONS_FLOW), s3c24xx_serial_stop_tx() calls s3c24xx_serial_rx_enable() and s3c24xx_serial_start_tx() calls s3c24xx_serial_rx_disable(). The serial core framework invokes the .stop_tx() and .start_tx() callbacks with the port->lock spinlock already held. Furthermore, all internal driver paths that invoke stop_tx (such as the DMA TX completion handler s3c24xx_serial_tx_dma_complete() or the PIO TX IRQ handler s3c24xx_serial_tx_irq()) also acquire port->lock prior to calling it. (Note that s3c24xx_serial_start_tx() is only invoked by the serial core). However, s3c24xx_serial_rx_enable() and s3c24xx_serial_rx_disable() unconditionally attempt to acquire port->lock again using uart_port_lock_irqsave(). Since spinlocks are not recursive, this causes a deadlock on the same CPU when console flow control is engaged. Remove the redundant lock acquisition from both rx helper functions.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Awaiting Analysis

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2026-07-25 10:17:39.187000

Last modified

2026-11-03 18:15:39.353000

View original CVE JSON

{
  "id": "CVE-2026-64528",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-07-25T10:17:39.187",
  "lastModified": "2026-11-03T18:15:39.353",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: serial: samsung: Remove redundant port lock acquisition in rx helpers\n\nSashiko identified a deadlock when the console flow is engaged [1].\n\nWhen console flow control is enabled (UPF_CONS_FLOW),\ns3c24xx_serial_stop_tx() calls s3c24xx_serial_rx_enable() and\ns3c24xx_serial_start_tx() calls s3c24xx_serial_rx_disable().\n\nThe serial core framework invokes the .stop_tx() and .start_tx()\ncallbacks with the port->lock spinlock already held. Furthermore, all\ninternal driver paths that invoke stop_tx (such as the DMA TX\ncompletion handler s3c24xx_serial_tx_dma_complete() or the PIO TX IRQ\nhandler s3c24xx_serial_tx_irq()) also acquire port->lock prior to\ncalling it. (Note that s3c24xx_serial_start_tx() is only invoked by the\nserial core).\n\nHowever, s3c24xx_serial_rx_enable() and s3c24xx_serial_rx_disable()\nunconditionally attempt to acquire port->lock again using\nuart_port_lock_irqsave(). Since spinlocks are not recursive, this\ncauses a deadlock on the same CPU when console flow control is engaged.\n\nRemove the redundant lock acquisition from both rx helper functions."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "drivers/tty/serial/samsung_tty.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "b497549a035c2a81b71c7a27f2b00c8a16c09423",
              "lessThan": "ee9eb72be95490602c493db050c73d925c3a4d74",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "b497549a035c2a81b71c7a27f2b00c8a16c09423",
              "lessThan": "10014eb7eee351f7b587f8ac85830f0c9343cb9a",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "b497549a035c2a81b71c7a27f2b00c8a16c09423",
              "lessThan": "f4c3e63fa8639aedf96fb200d9939945a9eed51e",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "b497549a035c2a81b71c7a27f2b00c8a16c09423",
              "lessThan": "a9c22e0f93ba18322a6623ecdda2f0cd858ca350",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "b497549a035c2a81b71c7a27f2b00c8a16c09423",
              "lessThan": "14143ec10d69f42806b5d7b046f0fd1b835831ae",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "b497549a035c2a81b71c7a27f2b00c8a16c09423",
              "lessThan": "9fd48937046efc9abb89379d63ee9cc5c661d711",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "b497549a035c2a81b71c7a27f2b00c8a16c09423",
              "lessThan": "9c92b42207978559e32903c3098aaf5c5b5788b2",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "b497549a035c2a81b71c7a27f2b00c8a16c09423",
              "lessThan": "a3bb136bff5e6a5e48cdd813246c9c4686feaaa9",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "drivers/tty/serial/samsung_tty.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "2.6.27",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "2.6.27",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.10.259",
              "lessThanOrEqual": "5.10.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.15.210",
              "lessThanOrEqual": "5.15.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.176",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.143",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.93",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.35",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.0.12",
              "lessThanOrEqual": "7.0.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.1",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/10014eb7eee351f7b587f8ac85830f0c9343cb9a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/14143ec10d69f42806b5d7b046f0fd1b835831ae",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9c92b42207978559e32903c3098aaf5c5b5788b2",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9fd48937046efc9abb89379d63ee9cc5c661d711",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a3bb136bff5e6a5e48cdd813246c9c4686feaaa9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a9c22e0f93ba18322a6623ecdda2f0cd858ca350",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ee9eb72be95490602c493db050c73d925c3a4d74",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f4c3e63fa8639aedf96fb200d9939945a9eed51e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}