CVE-2026-23472

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN

uart_write_room() and uart_write() behave inconsistently when

xmit_buf is NULL (which happens for PORT_UNKNOWN ports that were

never properly initialized):

- uart_write_room() returns kfifo_avail() which can be > 0

- uart_write() checks xmit_buf and returns 0 if NULL

This inconsistency causes an infinite loop in drivers that rely on

tty_write_room() to determine if they can write:

while (tty_write_room(tty) > 0) {

written = tty->ops->write(...);

// written is always 0, loop never exits

}

For example, caif_serial's handle_tx() enters an infinite loop when

used with PORT_UNKNOWN serial ports, causing system hangs.

Fix by making uart_write_room() also check xmit_buf and return 0 if

it's NULL, consistent with uart_write().

Reproducer: https://gist.github.com/mrpre/d9a694cc0e19828ee3bc3b37983fde13

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References