CVE-2026-80886
UnknownSummary
In the Linux kernel, a vulnerability in the msm serial driver was fixed by disabling DMA for the console UART. Concurrent writes from userspace and the kernel can trigger a race condition resulting in an infinite loop of the same messages. The fix disables DMA for the console UART to ensure a reliable output path.
Risk Assessment
During system startup or shutdown, an infinite loop of messages may occur, potentially disrupting system operation or making troubleshooting difficult.
Recommendation
Apply the Linux kernel update containing this fix.
Other vulnerabilities in Linux kernel
See all- CVE-2026-80885Unknown
In the Linux kernel, a fix was made for an uncancelled rxrpc OOB message handler in AFS. The fix cancels OOB message processing (typically to respond to security challenges) and moves it to afs_wq so it is also waited for. The OOB handler now returns if the net namespace is no longer live.
- CVE-2026-80884Unknown
In the Linux kernel, a fix was made in the NTB driver to store the original DMA address for future release. The DMA API requires that dma_free_attrs receive the exact dma_handle originally returned by the allocation function. The fix prevents modifying it.
- CVE-2026-80883Unknown
In the Linux kernel, a fix was made in the Tegra graphics drivers (gr2d/gr3d) to initialize the address register map before the HOST1X client is registered. Previously, client registration occurred before initialization, potentially allowing userspace to submit jobs before initialization. The fix moves register initialization before client registration.
- CVE-2026-80882Unknown
In the Linux kernel, a fix was made in the Tegra crypto driver to return ENOMEM when input buffer allocation fails for ccm. The fix ensures the ENOMEM error value is set when the allocation fails in tegra_ccm_do_one_req.
- CVE-2026-80881Unknown
In the Linux kernel, a fix was made in the OCFS2 filesystem regarding buffer head management in ocfs2_read_blocks(). The fix clarifies that the caller should not assume that the buffer head returned by sb_getblk() is exclusively owned and that put_bh() always drops b_count from 1 to 0. To avoid a scenario where a buffer head remains on hold and may be returned with BH_Uptodate set despite previous validation failure, BH_Uptodate is now cleared immediately after the validate() callback detects data inconsistency.
- CVE-2026-80880Unknown
In the Linux kernel, the IB/mlx5 driver has a vulnerability related to implicit ODP and rereg_mr operation. Due to child mkeys in the implicit ODP configuration, nothing can be changed in place for the parent mkey, so the whole structure must be rebuilt. Additionally, a race condition involving access to mr->pd by child keys was removed.
- CVE-2026-80879Unknown
A circular locking dependency was found in the Linux kernel's OCFS2 filesystem during direct I/O write completion. The ocfs2_dio_end_io_write function could deadlock due to improper lock ordering involving system inodes (INODE_ALLOC, EXTENT_ALLOC, ORPHAN_DIR). The fix releases allocation contexts before acquiring the ORPHAN_DIR lock.
- CVE-2026-80878Unknown
In the Linux kernel, the AFS filesystem has a memory leak related to an ungot volume. The afs_lookup_volume_rcu() function does not release a dying volume when afs_try_get_volume() fails.
- CVE-2026-80877Unknown
In the Linux kernel, the AFS filesystem has a memory leak related to the vllist in afs_update_cell(). When the new list is empty (nr_servers == 0), the old list is not replaced, leading to a leak of the new list.
- CVE-2026-80876Unknown
A vulnerability was found in the Linux kernel's ring buffer mechanism used by ftrace. When RB_FORCE_8BYTE_ALIGNMENT is enabled (e.g., on riscv64 with CONFIG_HAVE_64BIT_ALIGNED_ACCESS), ring_buffer_event_length() incorrectly calculates the length of small events, reporting a data length 4 bytes larger than expected. This causes inconsistent results in ftrace tests (trace_marker_raw).
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: serial: msm: Disable DMA for kernel console UART At the moment, concurrent writes from userspace and the kernel to the console can trigger a race condition that results in an infinite loop of the same messages printed over and over again. This is most likely to happen during system startup or shutdown when the init system starts/stops a large number of system services that interact with various kernel code. When userspace writes to the TTY device, the driver initiates an asynchronous DMA transfer and releases the port lock. At the same moment, the kernel printk path might grab the port lock and re-configure the UART controller for PIO, without waiting for the DMA operation to complete. It seems like this collision results in zero progress being reported for the DMA engine, so the same text is printed to the console over and over again. For the kernel console, we want a reliable output path that will be functional even during crashes etc. So rather than implementing complex code to synchronize the kernel console write routines with the userspace DMA write routines, simply disable DMA for the console UART instance. Similar checks exist in many other serial drivers, e.g. 8250_port.c, imx.c, sh-sci.c etc.