CVE-2026-74655

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> serial: qcom-geni: fix TX DMA buffer flush<br /> <br /> When transmit flushing a qcom-geni UART during an ongoing TX DMA, the<br /> UART gets stuck infinitely repeating corrupted TX DMA frames.<br /> <br /> The DMA-mode uart_ops does not provide a flush_buffer callback, so an<br /> in-flight transfer can complete after serial core has reset the transmit<br /> kfifo, underflowing its length and resubmitting page-sized transfers<br /> indefinitely. Add one that stops the transfer and clears tx_remaining<br /> and tx_queued.<br /> <br /> The stop path was also broken: it unmapped the buffer while the serial<br /> engine could still read it, and never reset the TX DMA state machine.<br /> Cancel the main sequencer command first, then reset the state machine<br /> and wait for it before unmapping. Drop the early return so a pending<br /> mapping is also cleaned up when the main command is inactive.<br /> <br /> The bug can be triggered from userspace with a large write immediately<br /> followed by TCOFLUSH. A following tcdrain will hang forever. The bug was<br /> reproduced and this fix was validated on Arduino Uno Q (QRB2210)<br /> using /dev/ttyHS1.