Race condition in Linux kernel - CVE-2026-93123

Vulnerability identifier: #VU150875

CSH Severity: Low

CVSS v4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-93123

CWE-ID: CWE-362

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to discard newly written serial data.

The vulnerability exists due to a race condition in the qcom GENI serial DMA transmit completion path when a stale DMA completion is handled after the transmit FIFO is flushed and new data is written. A local user can cause the stale completion to advance the transmit FIFO and discard the new data.

Exploitation requires the hardware DMA transfer to complete before its completion interrupt is handled.

Linux kernel
Debian Linux
Ubuntu
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)
linux (Debian package)

Install security update from vendor's repository.

linux (Ubuntu package) - update to 7.0.0-42.42
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17
linux (Debian package) - update to 6.12.111-1

• https://git.kernel.org/stable/c/231c84fe7ec40e4a06c398c0591d5b8e823d68e1
• https://git.kernel.org/stable/c/59faa59c25a0a098fbc86275408d7c8405015702
• https://git.kernel.org/stable/c/7ea38c49e7178960926657863299face6dc0e1b0
• https://git.kernel.org/stable/c/c02d030747c46da33faf406dd772ef91100efa27

• Race condition in Linux kernel tty serial driver
• Debian update for linux
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more