CVE-2026-80737

A flaw was found in the Linux kernel's amba-pl011 serial driver. Improper synchronization during Direct Memory Access (DMA) teardown allows a transmit (TX) callback to access memory after it has been freed. This use-after-free vulnerability could lead to memory corruption and system instability. Additionally, the receive (RX) poll timer can read RX buffers without proper locking, further contributing to potential data integrity issues.

A use after free can occur in the ARM PL011 serial driver during DMA shutdown because dmaengine_terminate_all does not wait for a running DMA callback. The TX callback may still access the TX buffer after it has been freed, and the RX poll timer may read RX DMA buffers without the port lock while teardown is freeing them. For the CVSS the PR:L is used because triggering normally requires a local process with access to the affected serial port or another local path that can drive UART DMA shutdown. The issue is not network reachable and depends on systems using PL011 with DMA enabled. Impact is at least local denial of service via kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.