{"id":"CVE-2026-63883","summary":"serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nserial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ\n\nWhen uart_flush_buffer() runs before the DMA completion IRQ is delivered,\nthe following race can occur (all steps serialized by uart_port_lock):\n\n  1. DMA starts: tx_remaining = N, kfifo contains N bytes\n  2. DMA completes in hardware; IRQ is pending but not yet delivered\n  3. uart_flush_buffer() acquires the port lock and calls kfifo_reset(),\n     making kfifo_len() = 0 while tx_remaining remains N\n  4. uart_flush_buffer() releases the port lock\n  5. DMA IRQ fires; handle_tx_dma() acquires the port lock and calls\n     uart_xmit_advance(uport, tx_remaining) on an empty kfifo\n\nuart_xmit_advance() increments kfifo-\u003eout by tx_remaining. Since\nkfifo_reset() already set both in and out to 0, out wraps past in,\ncausing kfifo_len() to return UART_XMIT_SIZE - tx_remaining. The next\nstart_tx_dma() call then submits a DMA transfer of stale buffer data.\n\nFix this by snapshotting kfifo_len() at the start of handle_tx_dma()\nand skipping uart_xmit_advance() when fifo_len \u003c tx_remaining, which\nindicates the kfifo was reset by a preceding flush.","modified":"2026-07-22T05:29:58.782534019Z","published":"2026-07-19T14:54:56.356Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63883.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/0d2c41a8b00934ddf8a7c1b4cf72dffa1e629c46"},{"type":"WEB","url":"https://git.kernel.org/stable/c/452d6fa37ae9b021f4f6d397dbae077f7296f6f4"},{"type":"WEB","url":"https://git.kernel.org/stable/c/654f45a8569f3cd6ff20bd724a18e0cce65893ba"},{"type":"WEB","url":"https://git.kernel.org/stable/c/b1159dce10b38eb795e4c96cdc4d34b83cec81c5"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c91ea13375f70f6271a0183445e34e83b8f4d8f7"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63883.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63883"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"2aaa43c7077833301c237684cd7bc9ae5e3dec95"},{"fixed":"c91ea13375f70f6271a0183445e34e83b8f4d8f7"},{"fixed":"b1159dce10b38eb795e4c96cdc4d34b83cec81c5"},{"fixed":"654f45a8569f3cd6ff20bd724a18e0cce65893ba"},{"fixed":"0d2c41a8b00934ddf8a7c1b4cf72dffa1e629c46"},{"fixed":"452d6fa37ae9b021f4f6d397dbae077f7296f6f4"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63883.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.3.0"},{"fixed":"6.6.143"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.93"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.35"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.0.12"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63883.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L"}]}