CVE-2026-63883

A flaw was found in the Linux kernel's qcom_geni serial driver. A race condition can occur when the uart_flush_buffer() function executes before the Direct Memory Access (DMA) completion interrupt is processed. This timing issue can lead to a kernel First-In, First-Out (kfifo) buffer underflow. Consequently, stale buffer data may be transferred via DMA, potentially leading to information disclosure or data integrity issues.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux and Red Hat In-Vehicle OS because exploitation requires local unprivileged access, precise race window timing, and physical or virtualized Qualcomm hardware. On standard Red Hat server environments running on typical enterprise architectures, this driver is not engaged, limiting exposure primarily to specialized ARM or automotive platforms with Qualcomm GENI serial controllers. Under these specific conditions, an attacker able to trigger concurrent buffer flushes during active direct memory access transfers could observe stale memory contents transmitted across the serial interface.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.