CVE-2026-74654
serial: 8250_dma: Clear stale RX state on shutdown
Description
In the Linux kernel, the following vulnerability has been resolved: serial: 8250_dma: Clear stale RX state on shutdown serial8250_release_dma() terminates RX DMA and releases the channel, but leaves rx_running set. If the port is closed while an RX transfer is active, the stale state remains while rxchan is NULL until the channel is requested again on the next open. The DesignWare BUSY workaround added by commit a7b9ce39fbe4 ("serial: 8250_dw: Ensure BUSY is deasserted") calls serial8250_rx_dma_flush() from the LCR write path during startup. This happens before serial8250_request_dma() obtains a new RX channel. On reopen, the stale rx_running state therefore makes the flush path pass a NULL channel to dmaengine_pause(), causing a kernel Oops. Clear rx_running after terminating RX DMA, matching the TX cleanup. Also make the flush helper return if the DMA object or RX channel is not available so startup and teardown paths cannot pass a NULL channel to the DMAengine API.
INFO
Published Date :
Aug. 22, 2026, 4:16 p.m.
Last Modified :
Aug. 22, 2026, 4:16 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products
The following products are affected by CVE-2026-74654
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
Solution
- Clear stale rx_running state after terminating RX DMA.
- Ensure flush helper returns if DMA or RX channel is unavailable.
- Apply updates to the Linux kernel.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-74654.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-74654 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-74654
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-74654 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-74654 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 22, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '0fcb7901f9d61a325b4c5b88c600383bcbeb97fe', 'lessThan': 'bf4fb620e02962b2b52500a4b3d8420f351eb46a', 'versionType': 'git'}, {'status': 'affected', 'version': '0fcb7901f9d61a325b4c5b88c600383bcbeb97fe', 'lessThan': 'e10f06ee050a08930e2339b6fec7148fd0b2a8f6', 'versionType': 'git'}, {'status': 'affected', 'version': '0fcb7901f9d61a325b4c5b88c600383bcbeb97fe', 'lessThan': 'd06cfb1add4a2d5b393e9e31f49ebbd168beea49', 'versionType': 'git'}, {'status': 'affected', 'version': '0fcb7901f9d61a325b4c5b88c600383bcbeb97fe', 'lessThan': 'e7a5d792cf64a2096e18f1d573cc3d01cba15e92', 'versionType': 'git'}, {'status': 'affected', 'version': '0fcb7901f9d61a325b4c5b88c600383bcbeb97fe', 'lessThan': '9f2444f4c0e4b06f61bae38da87c9c94c78efa86', 'versionType': 'git'}, {'status': 'affected', 'version': '0fcb7901f9d61a325b4c5b88c600383bcbeb97fe', 'lessThan': 'ae05d9e50b6b9f246c110b3bdc03676145c2d0d4', 'versionType': 'git'}, {'status': 'affected', 'version': '0fcb7901f9d61a325b4c5b88c600383bcbeb97fe', 'lessThan': 'e7e3cc6709caa49d1d6ce6c1f7cb305e38675cc9', 'versionType': 'git'}, {'status': 'affected', 'version': '0fcb7901f9d61a325b4c5b88c600383bcbeb97fe', 'lessThan': 'e2fe6a0efecbef00e3ecc2db64dd5afa8c212b41', 'versionType': 'git'}], 'programFiles': ['drivers/tty/serial/8250/8250_dma.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.19'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.19', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.265', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.216', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.183', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.152', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.104', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.45', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.9', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/tty/serial/8250/8250_dma.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: serial: 8250_dma: Clear stale RX state on shutdown serial8250_release_dma() terminates RX DMA and releases the channel, but leaves rx_running set. If the port is closed while an RX transfer is active, the stale state remains while rxchan is NULL until the channel is requested again on the next open. The DesignWare BUSY workaround added by commit a7b9ce39fbe4 ("serial: 8250_dw: Ensure BUSY is deasserted") calls serial8250_rx_dma_flush() from the LCR write path during startup. This happens before serial8250_request_dma() obtains a new RX channel. On reopen, the stale rx_running state therefore makes the flush path pass a NULL channel to dmaengine_pause(), causing a kernel Oops. Clear rx_running after terminating RX DMA, matching the TX cleanup. Also make the flush helper return if the DMA object or RX channel is not available so startup and teardown paths cannot pass a NULL channel to the DMAengine API. Added Reference https://git.kernel.org/stable/c/9f2444f4c0e4b06f61bae38da87c9c94c78efa86 Added Reference https://git.kernel.org/stable/c/ae05d9e50b6b9f246c110b3bdc03676145c2d0d4 Added Reference https://git.kernel.org/stable/c/bf4fb620e02962b2b52500a4b3d8420f351eb46a Added Reference https://git.kernel.org/stable/c/d06cfb1add4a2d5b393e9e31f49ebbd168beea49 Added Reference https://git.kernel.org/stable/c/e10f06ee050a08930e2339b6fec7148fd0b2a8f6 Added Reference https://git.kernel.org/stable/c/e2fe6a0efecbef00e3ecc2db64dd5afa8c212b41 Added Reference https://git.kernel.org/stable/c/e7a5d792cf64a2096e18f1d573cc3d01cba15e92 Added Reference https://git.kernel.org/stable/c/e7e3cc6709caa49d1d6ce6c1f7cb305e38675cc9