CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN
In the Linux kernel, the following vulnerability has been resolved:
serial: core: fix infinite loop in handletx() for PORTUNKNOWN
uartwriteroom() and uartwrite() behave inconsistently when xmitbuf is NULL (which happens for PORTUNKNOWN ports that were never properly initialized):
- uartwriteroom() returns kfifoavail() which can be > 0 - uartwrite() checks xmitbuf and returns 0 if NULL
This inconsistency causes an infinite loop in drivers that rely on ttywriteroom() to determine if they can write:
while (ttywriteroom(tty) > 0) { written = tty->ops->write(...); // written is always 0, loop never exits }
For example, caifserial's handletx() enters an infinite loop when used with PORTUNKNOWN serial ports, causing system hangs.
Fix by making uartwriteroom() also check xmitbuf and return 0 if it's NULL, consistent with uartwrite().
Reproducer: https://gist.github.com/mrpre/d9a694cc0e19828ee3bc3b37983fde13
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.114 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.20 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.19.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.4-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.19.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.115-2~deb12u1 - Compensating control
Modify Linux kernel serial core uart_write_room() to check xmit_buf and return 0 when xmit_buf is NULL, consistent with uart_write(), preventing the infinite loop in handle_tx() for PORT_UNKNOWN ports.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23472?
CVE-2026-23472 is classified as a medium severity vulnerability due to its potential impact on system stability.
How do I fix CVE-2026-23472?
To fix CVE-2026-23472, ensure you update your Linux kernel to a version that includes the patch addressing this infinite loop issue.
What systems are affected by CVE-2026-23472?
CVE-2026-23472 affects the Linux kernel, particularly in instances where serial communication is utilized.
What is the nature of the vulnerability in CVE-2026-23472?
CVE-2026-23472 involves an infinite loop in the handle_tx() function when dealing with PORT_UNKNOWN, which can lead to system hangs.
When was CVE-2026-23472 reported or discovered?
CVE-2026-23472 was reported as part of a series of fixes in the Linux kernel addressing various stability issues.