CVE-2026-43061

Vulnerability

In the Linux kernel's serial 8250 driver, when DMA is used for transmission, the function dmaengine_terminate_async does not guarantee that the callback __dma_tx_complete will run. The callback is the only place where the flag dma->tx_running gets cleared. If a DMA transaction is canceled and the callback never executes, dma->tx_running remains set, causing a deadlock where no new TX DMA transactions can be scheduled.

Exploitation

The deadlock is triggered when a DMA transaction is canceled (e.g., by flushing the DMA queue) and the termination callback fails to run. The attacker requires local access to the serial port to initiate a DMA transfer and then cancel it, potentially through normal system operations. No special privileges are needed if the serial port is accessible to unprivileged users.

Impact

Once dma->tx_running is stuck, the serial port's DMA-based transmission permanently stops. This leads to a denial of service (DoS) of the serial output, which can disrupt console logging, modem communications, or any application relying on high-speed serial I/O. In critical systems, the loss of serial console may hinder debugging or system recovery.

Mitigation

The fix clears dma->tx_running immediately after terminating the DMA transaction while holding the UART port lock, ensuring serialized access. The patch has been committed to the stable kernel tree. Users should apply the kernel update containing the commit to resolve the vulnerability.