HIGH Introduced in 2.6.39
amba-pl011 DMA UAF
CVE-2026-80737
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.9MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: synchronize DMA teardown dmaengine_terminate_all() does not wait for a running callback, so the TX callback can still touch the TX buffer after it is freed. The RX poll timer reads the RX buffers without the port lock. Switch to dmaengine_terminate_sync() and delete the RX timer before freeing the buffers.
02KernelScan AI Analysis
Risk summary
A race condition in the PL011 serial driver's DMA teardown path allows a local user to trigger a use-after-free when the TX DMA callback accesses a freed buffer or the RX poll timer reads freed RX buffers. This can lead to memory corruption, potentially resulting in privilege escalation or a kernel panic. The vulnerability requires local access and specific hardware using the AMBA PL011 UART with DMA enabled.
Vulnerability analysis
During DMA teardown in the PL011 serial driver, the TX DMA channel is terminated without waiting for an in-flight callback to finish, so the callback can still access the TX buffer after it has been freed. Separately, the RX poll timer can continue running and read RX buffers that are being freed without proper synchronization. The fix switches to a synchronous DMA termination that waits for callbacks to complete, and deletes the RX poll timer before freeing the RX buffers. The vulnerable code path is reachable locally on systems using AMBA PL011 UART hardware with DMA enabled, requiring no special privileges beyond local access to the serial device.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 2.6.39 | 5.10.267 | a38fae9d212e |
| 5.15 | 2.6.39 | 5.15.218 | 44bd0ecc3444 |
| 6.1 | 2.6.39 | 6.1.185 | f70c9d4fba46 |
| 6.12 | 2.6.39 | 6.12.106 | 9f6989e477f0 |
| 6.18 | 2.6.39 | 6.18.45 | 5974cb66681e |
| 6.6 | 2.6.39 | 6.6.154 | c8c8e895f65f |
| 7.1 | 2.6.39 | 7.1.9 | fdfb46c38724 |
| mainline | 2.6.39 | 7.2 | 440915499231 |
| cip/5.10 | 2.6.39 | 5.10.268-cip77 | a38fae9d212e |
| cip/5.10-rt | 2.6.39 | 5.10.268-cip77-rt34 | a38fae9d212e |
| cip/6.1 | 2.6.39 | 6.1.187-cip60 | f70c9d4fba46 |
| cip/6.1-rt | 2.6.39 | 6.1.189-cip61-rt32 | f70c9d4fba46 |
| cip/6.12 | 2.6.39 | 6.12.108-cip31 | 9f6989e477f0 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.108-cip31 |
| cip/6.1 | Fixed in 6.1.187-cip60 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.268-cip77 |
| cip/5.10-rt | Fixed in 5.10.268-cip77-rt34 |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |
| cip/4.4 | Affected — no CIP fix yet (latest 4.4.302-cip115) |
| cip/4.4-rt | Affected — no CIP fix yet (latest 4.4.302-cip115-rt63) |