CVE-2026-23472

Vulnerability

The Linux kernel's serial core contains an inconsistency between uart_write_room() and uart_write() when the transmit buffer (xmit_buf) is NULL. This occurs for PORT_UNKNOWN serial ports that were never properly initialized. The function uart_write_room() returns kfifo_avail(), which can be greater than zero even when xmit_buf is NULL, while uart_write() checks for xmit_buf and returns 0 if it is NULL [1].

Exploitation

A driver (such as caif_serial) that relies on tty_write_room() to determine write availability can enter an infinite loop: it repeatedly calls tty_write_room(), which returns a positive value, and then calls tty->ops->write(), which always returns 0 because uart_write() returns early due to the missing buffer. This loop never exits, causing a system hang [2]. The attack surface is limited to configurations where a PORT_UNKNOWN serial port is used, and no authentication is required for an attacker to trigger this if they can force such a port to be active.

Impact

The vulnerability results in a denial of service (system hang) on systems using affected drivers with uninitialized serial ports. The impact is local but can be triggered without privileges if an attacker can cause the vulnerable code path to be executed.

Mitigation

The fix has been merged into the Linux kernel stable tree [3]. Users should apply the kernel update that includes the commit making uart_write_room() also check xmit_buf and return 0 if it is NULL, consistent with uart_write(). No workaround is available for unpatched kernels.