CVE-2026-74654

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> serial: 8250_dma: Clear stale RX state on shutdown<br /> <br /> serial8250_release_dma() terminates RX DMA and releases the channel, but<br /> leaves rx_running set. If the port is closed while an RX transfer is<br /> active, the stale state remains while rxchan is NULL until the channel is<br /> requested again on the next open.<br /> <br /> The DesignWare BUSY workaround added by commit a7b9ce39fbe4<br /> ("serial: 8250_dw: Ensure BUSY is deasserted") calls<br /> serial8250_rx_dma_flush() from the LCR write path during startup. This<br /> happens before serial8250_request_dma() obtains a new RX channel. On<br /> reopen, the stale rx_running state therefore makes the flush path pass a<br /> NULL channel to dmaengine_pause(), causing a kernel Oops.<br /> <br /> Clear rx_running after terminating RX DMA, matching the TX cleanup. Also<br /> make the flush helper return if the DMA object or RX channel is not<br /> available so startup and teardown paths cannot pass a NULL channel to the<br /> DMAengine API.