CVE-2026-74654

A flaw was found in the Linux kernel's 8250_dma serial driver. When a serial port is closed while an RX (receive) transfer is active, a stale state can persist where the rx_running flag remains set even though the receive channel is no longer available. If the port is subsequently reopened, a specific workaround function attempts to flush the receive data using a null channel, leading to a kernel Oops. This vulnerability could allow a local attacker to cause a denial of service by crashing the system.

A flaw in the Linux kernel 8250 DMA serial driver affects the kernel and kernel-rt packages in Red Hat Enterprise Linux 8, 9, and 10, and the kernel and kernel-ivos-qualcomm components in Red Hat In-Vehicle OS 2. Red Hat rates the impact of this flaw as LOW. When a serial port is closed while an RX DMA transfer is active, the shutdown path releases the RX DMA channel but leaves the rx_running state flag set. On the next open of the port, the DesignWare BUSY workaround invokes the RX DMA flush helper before a new RX channel has been requested, and the stale state causes a NULL channel to be passed to the DMAengine pause operation, resulting in a kernel Oops. A local user with access to an affected 8250 DMA-based serial device could trigger this flaw by closing and reopening the port while an RX transfer is active, causing a kernel crash and denial of service; there is no supported evidence of confidentiality or integrity impact. Red Hat Enterprise Linux 6 and 7 Extended Lifecycle Support are not affected because the vulnerable code is not present. Because the flaw is rated low impact and requires local access to an affected serial device together with a specific close/reopen timing, the fix has been deferred to a future update; the residual risk is limited to local denial of service on systems using affected 8250 DMA-based serial port configurations. The Red Hat impact rating of LOW is lower than the moderate CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting the constrained local attack path and the denial-of-service-only consequence.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.