Description

In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: synchronize DMA teardown dmaengine_terminate_all() does not wait for a running callback, so the TX callback can still touch the TX buffer after it is freed. The RX poll timer reads the RX buffers without the port lock. Switch to dmaengine_terminate_sync() and delete the RX timer before freeing the buffers.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-03T13:06:12.623Z",
  "pubdate": "2026-09-03T13:06:12.623Z",
  "executiveSummary": "This vulnerability involves a race condition within the Linux kernel's amba-pl011 serial driver during DMA teardown sequences. The issue stems from the use of an asynchronous termination function that fails to guarantee the completion of active DMA callbacks before resources are released.\nThe vulnerability type is categorized as a Use-After-Free (UAF) and a data race condition. Attackers who can trigger specific serial port operations or manipulate the driver's state could potentially cause the kernel to access freed memory buffers, leading to system instability, potential memory corruption, or arbitrary code execution.\nThe vulnerability affects the amba-pl011 serial driver subsystem. The risk implications are critical for systems relying on kernel-level serial communication, as successful exploitation could lead to privilege escalation or kernel panic.\nExploitation requires the ability to interact with the device driver, typically through local access or specific userspace interfaces that trigger serial port DMA activity. No external network exposure is required, but local attackers with appropriate permissions may weaponize the race window to interact with stale pointers.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of DMA termination within the amba-pl011 serial driver. Previously, the driver utilized dmaengine_terminate_all(), which is an asynchronous operation. This function triggers the termination of DMA transfers but does not wait for pending callbacks to finish execution. Consequently, a TX callback could attempt to access the TX buffer even after the driver has initiated the freeing process, resulting in a classic Use-After-Free scenario.\nFurthermore, the RX poll timer introduced an additional concurrency hazard. The timer was configured to access RX buffers without acquiring the necessary port lock, leading to a data race. In a multithreaded environment or on SMP systems, the RX timer could attempt to read from buffers while the main driver thread was reallocating or freeing them, leading to unpredictable system behavior and memory inconsistency.\nThe attack flow occurs during the driver's teardown phase. An attacker, having initiated high-frequency serial activity, triggers a teardown sequence. Because dmaengine_terminate_all() returns immediately, the system proceeds to deallocate memory buffers while the DMA hardware or the DMA controller callback mechanism still holds references to these memory addresses. If the callback executes concurrently with the memory deallocation, the kernel references an invalid memory address.\nThe exploitation process involves precise timing. By forcing the system to tear down the serial port while active DMA operations are pending, the attacker creates a race window. The RX poll timer adds another vector: because it lacks lock synchronization, it can be triggered to perform unsynchronized reads on buffers that are in the middle of a teardown state. This allows for reading kernel memory or inducing an invalid state that forces the kernel into a panic or potentially allows for control flow redirection if the freed buffer is reclaimed by a malicious process or payload.\nThe vulnerable component is the amba-pl011 DMA interaction layer. The lack of synchronization primitives between the DMA teardown path and the RX poll timer, combined with the asynchronous nature of the legacy DMA termination call, constitutes a fundamental flaw in the driver's lifecycle management."
}