CVE-2026-64528
In the Linux kernel, the following vulnerability has been resolved: tty: serial: samsung: Remove redundant port lock acquisition in rx helpers Sashiko identified a deadlock when the console flow is engaged [1]. When console flow control is enabled (UPF_CONS_FLOW), s3c24xx_serial_stop_tx() calls s3c24xx_serial_rx_enable() and s3c24xx_serial_start_tx() calls s3c24xx_serial_rx_disable(). The serial core framework invokes the .stop_tx() and .start_tx() callbacks with the port->lock spinlock already held. Furthermore, all internal driver paths that invoke stop_tx (such as the DMA TX completion handler s3c24xx_serial_tx_dma_complete() or the PIO TX IRQ handler s3c24xx_serial_tx_irq()) also acquire port->lock prior to calling it. (Note that s3c24xx_serial_start_tx() is only invoked by the serial core). However, s3c24xx_serial_rx_enable() and s3c24xx_serial_rx_disable() unconditionally attempt to acquire port->lock again using uart_port_lock_irqsave(). Since spinlocks are not recursive, this causes a deadlock on the same CPU when console flow control is engaged. Remove the redundant lock acquisition from both rx helper functions.
Affected versions
Linux kernel versions
2.6.27
and later are affected. Fixed in
5.10.259,
5.15.210,
6.1.176,
6.6.143,
6.12.93,
6.18.35,
7.0.12,
7.1
and their respective stable series.
References
8 totalFrequently asked questions
-
What is CVE-2026-64528?
CVE-2026-64528 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 2.6.27 onward and has been patched in 5.10.259, 5.15.210, 6.1.176 and others. CVE-2026-64528 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-64528?
Yes. CVE-2026-64528 has been patched. Fixed versions include 5.10.259, 5.15.210, 6.1.176 and others. If you are running Linux kernel 2.6.27 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-64528 actively exploited?
No. CVE-2026-64528 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.