In the Linux kernel, the following vulnerability has been resolved:
serial: sc16is7xx: fix TX fifo corruption
Sometimes, when a packet is received on channel A at almost the same time as a packet is about to be transmitted on channel B, we observe with a logic analyzer that the received packet on channel A is transmitted on channel B. In other words, the Tx buffer data on channel B is corrupted with data from channel A.
The problem appeared since commit 4409df5866b7 ("serial: sc16is7xx: change EFR lock to operate on each channels"), which changed the EFR locking to operate on each channel instead of chip-wise.
This commit has introduced a regression, because the EFR lock is used not only to protect the EFR registers access, but also, in a very obscure and undocumented way, to protect access to the data buffer, which is shared by the Tx and Rx handlers, but also by each channel of the IC.
Fix this regression first by switching to kfifo_out_linear_ptr() in sc16is7xx_handle_tx() to eliminate the need for a shared Rx/Tx buffer.
Secondly, replace the chip-wise Rx buffer with a separate Rx buffer for each channel.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | May 15, 2025 | Sep 4, 2024 |
| Suse | — | Upgrade dtb-amazonUpgrade dtb-apmUpgrade kernel-64kb-optionalUpgrade kernel-docs-htmlUpgrade kernel-64kb-livepatch-develUpgrade kselftests-kmp-azureUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-renesasUpgrade dtb-hisiliconUpgrade reiserfs-kmp-defaultUpgrade kernel-source-azureUpgrade dtb-alteraUpgrade kselftests-kmp-64kbUpgrade dtb-marvellUpgrade kernel-debug-livepatch-develUpgrade dlm-kmp-64kbUpgrade dtb-broadcomUpgrade gfs2-kmp-azureUpgrade dtb-amlogicUpgrade dtb-caviumUpgrade kernel-default-livepatchUpgrade reiserfs-kmp-64kbUpgrade dtb-amdUpgrade dtb-freescaleUpgrade kernel-rt_debugUpgrade kernel-zfcpdumpUpgrade kernel-debugUpgrade kernel-debug-develUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-vdsoUpgrade ocfs2-kmp-rtUpgrade kernel-azure-extraUpgrade cluster-md-kmp-defaultUpgrade dtb-exynosUpgrade kernel-kvmsmall-develUpgrade kernel-default-extraUpgrade kernel-rt_debug-develUpgrade kernel-devel-azureUpgrade gfs2-kmp-defaultUpgrade dtb-xilinxUpgrade dtb-allwinnerUpgrade kernel-default-develUpgrade dtb-appleUpgrade kernel-kvmsmallUpgrade kernel-rt-vdsoUpgrade kselftests-kmp-rtUpgrade kernel-default-livepatch-develUpgrade kernel-syms-rtUpgrade kernel-default-optionalUpgrade kernel-debug-vdsoUpgrade kernel-azure-vdsoUpgrade cluster-md-kmp-64kbUpgrade dtb-mediatekUpgrade dtb-armUpgrade dlm-kmp-defaultUpgrade kernel-rt_debug-vdsoUpgrade dtb-sprdUpgrade cluster-md-kmp-rtUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-rt-livepatch-develUpgrade kernel-default-base-rebuildUpgrade kernel-azure-develUpgrade kernel-default-baseUpgrade reiserfs-kmp-azureUpgrade kselftests-kmp-defaultUpgrade kernel-source-vanillaUpgrade kernel-devel-rtUpgrade kernel-docsUpgrade kernel-develUpgrade reiserfs-kmp-rtUpgrade kernel-azureUpgrade dtb-qcomUpgrade dlm-kmp-azureUpgrade kernel-rt-develUpgrade dtb-nvidiaUpgrade kernel-obs-buildUpgrade dlm-kmp-rtUpgrade kernel-rtUpgrade kernel-defaultUpgrade dtb-rockchipUpgrade ocfs2-kmp-defaultUpgrade kernel-64kb-extraUpgrade kernel-rt-extraUpgrade kernel-macrosUpgrade kernel-symsUpgrade kernel-64kb-develUpgrade ocfs2-kmp-64kbUpgrade dtb-socionextUpgrade kernel-azure-livepatch-develUpgrade cluster-md-kmp-azureUpgrade kernel-rt-optionalUpgrade kernel-source-rtUpgrade kernel-obs-qaUpgrade dtb-lgUpgrade gfs2-kmp-64kbUpgrade kernel-64kb | Dec 5, 2025 | Oct 8, 2024 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Sep 4, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub