CVE-2026-80737: serial: amba-pl011: synchronize DMA teardown
In the Linux kernel, the following vulnerability has been resolved:
serial: amba-pl011: synchronize DMA teardown
dmaengineterminateall() does not wait for a running callback, so the TX callback can still touch the TX buffer after it is freed. The RX poll timer reads the RX buffers without the port lock.
Switch to dmaengineterminatesync() and delete the RX timer before freeing the buffers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1
Event History
Frequently Asked Questions
Which systems should be prioritized for remediation?
Prioritize Linux systems using the amba-pl011 serial driver with DMA, particularly where TX and RX DMA teardown can occur. The provided information does not establish whether DMA is enabled by default or whether systems not using this driver are affected.