CVE-2026-64528: tty: serial: samsung: Remove redundant port lock acquisition in rx helpers
In the Linux kernel, the following vulnerability has been resolved:
tty: serial: samsung: Remove redundant port lock acquisition in rx helpers
Sashiko identified a deadlock when the console flow is engaged [1].
When console flow control is enabled (UPFCONSFLOW), s3c24xxserialstoptx() calls s3c24xxserialrxenable() and s3c24xxserialstarttx() calls s3c24xxserialrxdisable().
The serial core framework invokes the .stoptx() and .starttx() callbacks with the port->lock spinlock already held. Furthermore, all internal driver paths that invoke stoptx (such as the DMA TX completion handler s3c24xxserialtxdmacomplete() or the PIO TX IRQ handler s3c24xxserialtxirq()) also acquire port->lock prior to calling it. (Note that s3c24xxserialstarttx() is only invoked by the serial core).
However, s3c24xxserialrxenable() and s3c24xxserialrxdisable() unconditionally attempt to acquire port->lock again using uartportlockirqsave(). Since spinlocks are not recursive, this causes a deadlock on the same CPU when console flow control is engaged.
Remove the redundant lock acquisition from both rx helper functions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64528?
CVE-2026-64528 has a risk rating of 37.
How do I fix CVE-2026-64528?
To resolve CVE-2026-64528, update to the patched version of the Linux kernel that removes the redundant port lock acquisition.
What impact does CVE-2026-64528 have?
CVE-2026-64528 can lead to a potential deadlock situation when console flow control is engaged.
What systems are affected by CVE-2026-64528?
CVE-2026-64528 affects systems running the Linux kernel with specific serial port configurations.
Who discovered CVE-2026-64528?
CVE-2026-64528 was identified by a contributor named Sashiko.