UBUNTU-CVE-2026-74655: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: serial: qcom-geni: fix TX DMA buffer flush When transmit flushing a qcom-geni UART during an ongoing TX DMA, the UART gets stuck infinitely repeating corrupted TX DMA frames. The DMA-mode uartops does not provide a flushbuffer callback, so an in-flight transfer can complete after serial core has reset the transmit kfifo, underflowing its length and resubmitting page-sized transfers indefinitely. Add one that stops the transfer and clears txremaining and txqueued. The stop path was also broken: it unmapped the buffer while the serial engine could still read it, and never reset the TX DMA state machine. Cancel the main sequencer command first, then reset the state machine and wait for it before unmapping. Drop the early return so a pending mapping is also cleaned up when the main command is inactive. The bug can be triggered from userspace with a large write immediately followed by TCOFLUSH. A following tcdrain will hang forever. The bug was reproduced and this fix was validated on Arduino Uno Q (QRB2210) using /dev/ttyHS1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Update the qcom-geni UART DMA TX flush/stop path so a tcdrain or transmit flush stops the transfer, clears tx_remaining and tx_queued, cancels the main sequencer command first, resets the TX DMA state machine and waits for the reset to complete before unmapping the buffer; also remove the early return so pending mappings are cleaned up when the main command is inactive.
Event History
Frequently Asked Questions
Which systems are realistically exposed to this issue?
Systems using the affected Ubuntu kernel packages and a Qualcomm GENI UART in DMA mode are exposed. The issue was reproduced on an Arduino Uno Q (QRB2210) through /dev/ttyHS1.
What does an attacker or local user need to do to trigger it?
A local userspace process needs access to the affected UART device. The trigger is a large write followed immediately by TCOFLUSH while TX DMA is in progress; a subsequent tcdrain can hang indefinitely.
What is the operational impact if the issue is triggered?
The UART can become stuck repeatedly transmitting corrupted DMA frames indefinitely. Its transmit path may no longer drain, causing tcdrain to hang forever.
Is there a practical mitigation if the kernel update cannot be applied immediately?
Avoid flushing an affected qcom-geni UART during an active large DMA-backed transmission, particularly the large-write-then-TCOFLUSH sequence. Restrict untrusted local access to the affected serial device where possible.