CVE-2026-74653: serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx
In the Linux kernel, the following vulnerability has been resolved:
serial: 8250of: clear stuck empty-FIFO RX-timeout on LPC32xx
The NXP LPC32xx UART (PORTLPC3220) can latch an RX character-timeout interrupt while the RX FIFO is empty: IIR reports UARTIIRRXTIMEOUT (0x0c) but LSR.DR is clear. A character timeout is only cleared by reading RHR, but serial8250rxchars() reads RHR only when LSR.DR is set, so nothing ever clears the condition. The interrupt is level-triggered and re-fires immediately, so on a single-core ARM926 the resulting interrupt storm livelocks the CPU.
It is reproducible when userspace repeatedly opens the front-panel port (ttyS1): serial8250dosettermios() re-enables interrupts on unlock and the handler then spins forever with iir=0xcc lsr=0x60 ier=0x05, tripping the soft-lockup detector in serial8250handleirqlocked().
LPC32xx has no dedicated 8250 glue driver, it's driven by the generic 8250of. Add a hardware specific handleirq for PORTLPC3220, wired up in ofplatformserialsetup() the same way fsl8250handleirq is installed. The handler follows dw8250handleirq(): on an RX timeout with an empty FIFO (LSR.DR and LSR.BI clear) it does one throwaway RHR read to clear the condition, then calls serial8250handleirqlocked(). No real received data is ever discarded, and it is a no-op on healthy UARTs which never report a timeout with DR clear.
This is the same class of bug already worked around in other 8250 drivers; see commit 424d79183af0 ("serial: 8250dw: Avoid "too much work" from bogus rx timeout interrupt") which reports the identical iir=0xcc/lsr=0x60. See also UARTRXTIMEOUTQUIRK in 8250omap, and the note in 8250bcm7271.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.106 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.45 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.1.9 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
For Linux 8250_of on PORT_LPC3220, add and wire a hardware-specific handle_irq in of_platform_serial_setup(): when an RX timeout occurs with an empty FIFO (LSR.DR and LSR.BI clear), perform one throwaway RHR read to clear the condition, then call serial8250_handle_irq_locked().
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using an NXP LPC32xx UART identified as PORT_LPC3220 and driven by the generic 8250_of driver are affected. The described trigger involves the front-panel serial port ttyS1.
What is required to trigger the CPU livelock?
The UART must latch an RX character-timeout interrupt while its receive FIFO is empty, so IIR reports RX timeout while LSR.DR is clear. Repeated userspace opens of ttyS1 can reproduce the condition because serial8250_do_set_termios() re-enables interrupts when unlocking.
How can I identify an active occurrence?
An affected single-core ARM926 system can enter an interrupt storm and become CPU-livelocked, potentially triggering the soft-lockup detector in serial8250_handle_irq_locked(). Diagnostic output may show iir=0xcc, lsr=0x60, and ier=0x05 while the handler repeatedly runs.