CVE-2026-97481

A flaw was found in the Linux kernel's 8250 serial port driver. An attacker communicating over the serial interface can cause a Denial of Service (DoS) by flooding the port with messages during the system startup phase. Due to missing error handling for First-In, First-Out (FIFO) buffer interrupts, the system repeatedly re-triggers the interrupt without clearing it. This results in a continuous loop within the interrupt service routine (ISR), leading to a kernel soft lockup and system unresponsiveness.

A flaw was found in the Linux kernel 8250 serial port driver that results in a low-impact denial of service. The driver's interrupt service routine (ISR) does not handle the FIFO error interrupt (FIFOE) status: when a FIFO error is raised while no data is ready (DR), the ISR reports IRQ_HANDLED without clearing the error condition, so the interrupt is immediately retriggered. An attacker who is able to communicate over the serial (UART) interface can flood the port with messages during the system startup phase, trapping the CPU in a continuous interrupt loop and causing a kernel soft lockup that leaves the system unresponsive. Only availability is affected; there is no impact on confidentiality or integrity. This issue affects the kernel and kernel-rt packages in Red Hat Enterprise Linux 8, 9, and 10, the kernel packages in Red Hat In-Vehicle OS 2, and OpenShift Container Platform 4.12 and later through the RHEL CoreOS 8 and 9 container images. Red Hat Enterprise Linux 6 and 7 Extended Lifecycle Support are not affected because the vulnerable code is not present in those releases. While the Red Hat CVSS v3 base score for this flaw is 5.5 (Moderate), Red Hat rates the overall impact as Low because triggering the flaw requires access to the serial line and rare timing conditions during the startup phase. Because of this low impact, fixes for the affected products are deferred to a future update; the residual risk is a denial of service limited to systems whose serial port is accessible to a potential attacker during startup.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.