SB2026091884 - Race condition in Linux kernel tty serial driver

Description

This security bulletin contains information about 1 vulnerability.

1) Race condition (CVE-ID: CVE-2026-93123)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to discard newly written serial data.

The vulnerability exists due to a race condition in the qcom GENI serial DMA transmit completion path when a stale DMA completion is handled after the transmit FIFO is flushed and new data is written. A local user can cause the stale completion to advance the transmit FIFO and discard the new data.

Exploitation requires the hardware DMA transfer to complete before its completion interrupt is handled.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/231c84fe7ec40e4a06c398c0591d5b8e823d68e1
• https://git.kernel.org/stable/c/59faa59c25a0a098fbc86275408d7c8405015702
• https://git.kernel.org/stable/c/7ea38c49e7178960926657863299face6dc0e1b0
• https://git.kernel.org/stable/c/c02d030747c46da33faf406dd772ef91100efa27