serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (Linux Linux)

CVE-2026-23472
MEDIUM 5.5

En bref

Source
NVD
EPSS
EPSS 0.15 % · centile 5 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
Linux
Statut NVD
Modified

Description

In the Linux kernel, the following vulnerability has been resolved: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN uart_write_room() and uart_write() behave inconsistently when xmit_buf is NULL (which happens for PORT_UNKNOWN ports that were never properly initialized): - uart_write_room() returns kfifo_avail() which can be > 0 - uart_write() checks xmit_buf and returns 0 if NULL This inconsistency causes an infinite loop in drivers that rely on tty_write_room() to determine if they can write: while (tty_write_room(tty) > 0) { written = tty->ops->write(...); // written is always 0, loop never exits } For example, caif_serial's handle_tx() enters an infinite loop when used with PORT_UNKNOWN serial ports, causing system hangs. Fix by making uart_write_room() also check xmit_buf and return 0 if it's NULL, consistent with uart_write(). Reproducer: https://gist.github.com/mrpre/d9a694cc0e19828ee3bc3b37983fde13

Faiblesses (CWE)

  • CWE-835 — Boucle dont la condition de sortie est inatteignable (boucle infinie)

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1MEDIUM 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD · nvd@nist.gov (Primary)

Références européennes

Avis du CERT-FR

Configurations affectées (CPE NVD)

Produits affectés

ProduitVersions
Linux · Linuxaffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 91c2a5d201daf66fa3f42b8a383bb89174bde2c8 ; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < c9e845014723d552944cec4e146ec7b841cda34d ; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < d45cfa70bf0159afb31cb03d2d16ec5a5053460c ; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < efe85a557186b7fe915572ae93a8f3f78bfd9a22 ; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < bc70f2b36cf474d5cc8ecbcaf57f3e326fdec67c ; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 455ce986fa356ff43a43c0d363ba95fa152f21d5
Linux · Linuxaffected 2.6.12 ; unaffected 0 < 2.6.12 ; unaffected 6.1.191 ≤ 6.1.* ; unaffected 6.6.160 ≤ 6.6.* ; unaffected 6.12.114 ≤ 6.12.* ; unaffected 6.18.20 ≤ 6.18.*

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD