CVE-2026-23472

serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN

5.5 MediumFix available

In the Linux kernel, the following vulnerability has been resolved:

serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN

uart_write_room() and uart_write() behave inconsistently when xmit_buf is NULL (which happens for PORT_UNKNOWN ports that were never properly initialized):

uart_write_room() returns kfifo_avail() which can be > 0
uart_write() checks xmit_buf and returns 0 if NULL

This inconsistency causes an infinite loop in drivers that rely on tty_write_room() to determine if they can write:

while (tty_write_room(tty) > 0) { written = tty->ops->write(...); // written is always 0, loop never exits }

For example, caif_serial's handle_tx() enters an infinite loop when used with PORT_UNKNOWN serial ports, causing system hangs.

Fix by making uart_write_room() also check xmit_buf and return 0 if it's NULL, consistent with uart_write().

Reproducer: https://gist.github.com/mrpre/d9a694cc0e19828ee3bc3b37983fde13

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.16%Up 0.1 points since Apr 4, 2026

What each source reports

NVD Score used 5.5

In the Linux kernel, the following vulnerability has been resolved:

serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN

uart_write_room() and uart_write() behave inconsistently when xmit_buf is NULL (which happens for PORT_UNKNOWN ports that were never properly initialized):

uart_write_room() returns kfifo_avail() which can be > 0
uart_write() checks xmit_buf and returns 0 if NULL

This inconsistency causes an infinite loop in drivers that rely on tty_write_room() to determine if they can write:

while (tty_write_room(tty) > 0) { written = tty->ops->write(...); // written is always 0, loop never exits }

For example, caif_serial's handle_tx() enters an infinite loop when used with PORT_UNKNOWN serial ports, causing system hangs.

Fix by making uart_write_room() also check xmit_buf and return 0 if it's NULL, consistent with uart_write().

Reproducer: https://gist.github.com/mrpre/d9a694cc0e19828ee3bc3b37983fde13

Record: CVE-2026-23472
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-835
Updated: 2026-11-05

CVE List No score

serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN

In the Linux kernel, the following vulnerability has been resolved:

serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN

uart_write_room() and uart_write() behave inconsistently when xmit_buf is NULL (which happens for PORT_UNKNOWN ports that were never properly initialized):

uart_write_room() returns kfifo_avail() which can be > 0
uart_write() checks xmit_buf and returns 0 if NULL

This inconsistency causes an infinite loop in drivers that rely on tty_write_room() to determine if they can write:

while (tty_write_room(tty) > 0) { written = tty->ops->write(...); // written is always 0, loop never exits }

For example, caif_serial's handle_tx() enters an infinite loop when used with PORT_UNKNOWN serial ports, causing system hangs.

Fix by making uart_write_room() also check xmit_buf and return 0 if it's NULL, consistent with uart_write().

Reproducer: https://gist.github.com/mrpre/d9a694cc0e19828ee3bc3b37983fde13

Record: CVE-2026-23472
Updated: 2026-11-05

EUVDEUVD-2026-18745 No score

In the Linux kernel, the following vulnerability has been resolved:

serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN

uart_write_room() and uart_write() behave inconsistently when xmit_buf is NULL (which happens for PORT_UNKNOWN ports that were never properly initialized):

uart_write_room() returns kfifo_avail() which can be > 0
uart_write() checks xmit_buf and returns 0 if NULL

This inconsistency causes an infinite loop in drivers that rely on tty_write_room() to determine if they can write:

while (tty_write_room(tty) > 0) { written = tty->ops->write(...); // written is always 0, loop never exits }

For example, caif_serial's handle_tx() enters an infinite loop when used with PORT_UNKNOWN serial ports, causing system hangs.

Fix by making uart_write_room() also check xmit_buf and return 0 if it's NULL, consistent with uart_write().

Reproducer: https://gist.github.com/mrpre/d9a694cc0e19828ee3bc3b37983fde13

Record: EUVD-2026-18745
Updated: 2026-11-05

GitHub AdvisoriesGHSA-xx77-8cp4-rx22 5.5

In the Linux kernel, the following vulnerability has been resolved: serial: core: fix infinite...

In the Linux kernel, the following vulnerability has been resolved:

serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN

uart_write_room() and uart_write() behave inconsistently when xmit_buf is NULL (which happens for PORT_UNKNOWN ports that were never properly initialized):

uart_write_room() returns kfifo_avail() which can be > 0
uart_write() checks xmit_buf and returns 0 if NULL

This inconsistency causes an infinite loop in drivers that rely on tty_write_room() to determine if they can write:

while (tty_write_room(tty) > 0) { written = tty->ops->write(...); // written is always 0, loop never exits }

For example, caif_serial's handle_tx() enters an infinite loop when used with PORT_UNKNOWN serial ports, causing system hangs.

Fix by making uart_write_room() also check xmit_buf and return 0 if it's NULL, consistent with uart_write().

Reproducer: https://gist.github.com/mrpre/d9a694cc0e19828ee3bc3b37983fde13

Record: GHSA-xx77-8cp4-rx22
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-835
Updated: 2026-11-02

OSVBELL-CVE-2026-23472 5.5

Record: BELL-CVE-2026-23472
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-04

OSVDEBIAN-CVE-2026-23472 5.5

In the Linux kernel, the following vulnerability has been resolved: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN uart_write_room() and uart_write() behave inconsistently when xmit_buf is NULL (which happens for PORT_UNKNOWN ports that were never properly initialized): - uart_write_room() returns kfifo_avail() which can be > 0 - uart_write() checks xmit_buf and returns 0 if NULL This inconsistency causes an infinite loop in drivers that rely on tty_write_room() to determine if they can write: while (tty_write_room(tty) > 0) { written = tty->ops->write(...); // written is always 0, loop never exits } For example, caif_serial's handle_tx() enters an infinite loop when used with PORT_UNKNOWN serial ports, causing system hangs. Fix by making uart_write_room() also check xmit_buf and return 0 if it's NULL, consistent with uart_write(). Reproducer: https://gist.github.com/mrpre/d9a694cc0e19828ee3bc3b37983fde13

Record: DEBIAN-CVE-2026-23472
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 21 moreShow less

OSVROOT-OS-DEBIAN-11-CVE-2026-23472 5.5

CVE-2026-23472 in linux - Patched by Root

Root has patched CVE-2026-23472 in the linux package for Root:Debian:11. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-11-CVE-2026-23472
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-12-CVE-2026-23472 5.5

CVE-2026-23472 in linux - Patched by Root

Root has patched CVE-2026-23472 in the linux package for Root:Debian:12. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-12-CVE-2026-23472
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVROOT-OS-UBUNTU-2204-CVE-2026-23472 5.5

CVE-2026-23472 in linux - Patched by Root

Root has patched CVE-2026-23472 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2204-CVE-2026-23472
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-06

OSVROOT-OS-UBUNTU-2404-CVE-2026-23472 5.5

CVE-2026-23472 in linux - Patched by Root

Root has patched CVE-2026-23472 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2404-CVE-2026-23472
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-06

OSVUBUNTU-CVE-2026-23472 5.5

Record: UBUNTU-CVE-2026-23472
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-11

OSVAZL-81831 No score

CVE-2026-23472 affecting package kernel 6.6.161.1-1

In the Linux kernel, the following vulnerability has been resolved:

serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN

uart_write_room() and uart_write() behave inconsistently when xmit_buf is NULL (which happens for PORT_UNKNOWN ports that were never properly initialized):

uart_write_room() returns kfifo_avail() which can be > 0
uart_write() checks xmit_buf and returns 0 if NULL

This inconsistency causes an infinite loop in drivers that rely on tty_write_room() to determine if they can write:

while (tty_write_room(tty) > 0) { written = tty->ops->write(...); // written is always 0, loop never exits }

For example, caif_serial's handle_tx() enters an infinite loop when used with PORT_UNKNOWN serial ports, causing system hangs.

Fix by making uart_write_room() also check xmit_buf and return 0 if it's NULL, consistent with uart_write().

Reproducer: https://gist.github.com/mrpre/d9a694cc0e19828ee3bc3b37983fde13

Record: AZL-81831
Updated: 2026-11-05

OSVCLSA-2026-1781344094 No score

kernel: Fix of 93 CVEs

irqchip: Fix refcount leak in platform_irqchip_probe {CVE-2023-53610}
IB/hfi1: Fix a memleak in init_credit_return {CVE-2024-26839}
RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() {CVE-2026-23335}
wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}
wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc() {CVE-2025-71100}
RDMA/core: always drop device refcount in ib_del_sub_device_and_put() {CVE-2025-71157}
drm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_sclk_range_table {CVE-2024-58052}
ionic: Fix netdev notifier unregister on failure {CVE-2024-56715}
uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind {CVE-2024-46739}
netfilter: xt_tcpmss: check remaining length before reading optlen {CVE-2026-43190}
usb: typec: altmodes/displayport: do not index invalid pin_assignments {CVE-2025-38391}
crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init {CVE-2023-52616}
eventpoll: defer struct eventpoll free to RCU grace period {CVE-2026-43074}
wifi: brcmsmac: Fix dma_free_coherent() size {CVE-2026-31661}
SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf {CVE-2025-71120}
netfilter: nf_conntrack_expect: skip expectations in other netns via proc {CVE-2026-31496}
platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data {CVE-2026-23370}
crypto: bcm - add error check in the ahash_hmac_init function {CVE-2024-56681}
nvme-pci: ensure we're polling a polled queue {CVE-2026-31523}
mmc: vub300: fix NULL-deref on disconnect {CVE-2026-31651}
kernel/irq/irqdomain.c: fix memory leak with using debugfs_lookup() {CVE-2023-52936}
ipmi: ipmb: Add check devm_kasprintf() returned value {CVE-2024-58051}
net: usb: pegasus: fix memory leak in update_eth_regs_async() {CVE-2026-23021}
ASoC: amd: fix memory leak in acp3x pdm dma ops {CVE-2026-23190}
udp: Deal with race between UDP socket address change and rehash {CVE-2024-57974}
team: avoid NETDEV_CHANGEMTU event when unregistering slave {CVE-2026-43234}
tcp: secure_seq: add back ports to TS offset {CVE-2026-23247}
udp: Fix wildcard bind conflict check when using hash2 {CVE-2026-31503}
netfilter: nft_set_pipapo: prevent overflow in lookup table allocation {CVE-2025-38162}
rxrpc: Fix recv-recv race of completed call {CVE-2025-38524}
netfilter: nf_tables: reject duplicate device on updates {CVE-2025-38678}
nf_tables: nft_dynset: fix possible stateful expression memleak in error path {CVE-2026-23399}
crypto: af_alg - limit RX SG extraction by receive buffer budget {CVE-2026-31677}
xfrm: account XFRMA_IF_ID in aevent size calculation {CVE-2026-43107}
KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop {CVE-2025-21839}
perf: Fix sample vs do_exit() {CVE-2025-38424}
netfilter: nf_tables: avoid chain re-validation if possible {CVE-2025-71160}
ksm: use range-walk function to jump over holes in scan_get_next_rmap_item {CVE-2025-68211}
net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime {CVE-2025-38470}
net: add proper RCU protection to /proc/net/ptype {CVE-2026-23255}
ALSA: ctxfi: Check the error for index mapping {CVE-2026-31777}
rseq: Fix segfault on registration when rseq_cs is non-zero {CVE-2025-38067}
RDMA/core: Don't expose hw_counters outside of init net namespace {CVE-2025-22089}
net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv {CVE-2026-22996}
Input: synaptics - fix crash when enabling pass-through port {CVE-2025-21746}
wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit {CVE-2026-31579}
ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use() {CVE-2025-38305}
driver core: fix potential NULL pointer dereference in dev_uevent() {CVE-2025-37800}
dm: fix NULL pointer dereference in __dm_suspend() {CVE-2025-40134}
net: let net.core.dev_weight always be non-zero {CVE-2025-21806}
exec:…

Record: CLSA-2026-1781344094
Updated: 2026-11-02

OSVCLSA-2026-1783791447 No score

kernel: Fix of 307 CVEs

gpiolib: cdev: Set lineevent_state::irq after IRQ register successfully {CVE-2022-48660}
ipv4: check for NULL idev in ip_route_use_hint() {CVE-2024-36008}
KEYS: trusted: Do not use WARN when encode fails {CVE-2024-36975}
Fix userfaultfd_api to return EINVAL as expected {CVE-2024-41027}
xhci: Fix null pointer dereference when host dies {CVE-2023-52898}
sctp: sysctl: auth_enable: avoid using current->nsproxy {CVE-2025-21638}
blk-mq: fix IO hang from sbitmap wakeup race {CVE-2024-26671}
net: openvswitch: fix flow memory leak in ovs_flow_cmd_new {CVE-2023-52977}
gpiolib: fix memory leak in gpiochip_setup_dev() {CVE-2022-48975}
HID: betop: check shape of output reports {CVE-2023-53015}
mm/swapfile: add cond_resched() in get_swap_pages() {CVE-2023-52932}
HV: hv_balloon: fix memory leak with using debugfs_lookup() {CVE-2023-52937}
drm/i915: Fix a memory leak with reused mmap_offset {CVE-2023-53002}
ptdma: pt_core_execute_cmd() should use spinlock {CVE-2023-53013}
RDMA/core: Fix ib block iterator counter overflow {CVE-2023-53026}
Bluetooth: hci_conn: Fix memory leaks {CVE-2023-53018}
scsi: target: pscsi: Fix bio_put() for error case {CVE-2024-26760}
sctp: Prevent TOCTOU out-of-bounds write {CVE-2025-40331}
pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() {CVE-2026-23038}
cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() {CVE-2025-40194}
ALSA: hda/cs8409: Fix possible NULL dereference {CVE-2024-50160}
nbd: don't allow reconnect after disconnect {CVE-2025-21731}
openvswitch: fix lockup on tx to unregistering netdev with carrier {CVE-2025-21681}
ext4: detect invalid INLINE_DATA + EXTENTS flag combination {CVE-2025-40167}
ext4: xattr: fix null pointer deref in ext4_raw_inode() {CVE-2025-68820}
net: fix memory leak in skb_segment_list for GRO packets {CVE-2026-22979}
wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode {CVE-2025-40321}
ipvs: fix ipv4 null-ptr-deref in route error path {CVE-2025-68813}
ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping {CVE-2025-40121}
i40e: Fix macvlan leak by synchronizing access to mac_filter_hash {CVE-2024-50041}
net/mlx5e: Fix NULL deref in mlx5e_tir_builder_alloc() {CVE-2024-50000}
bpf: Fix reference count leak in bpf_prog_test_run_xdp() {CVE-2026-22994}
xsk: check IFF_UP earlier in Tx path {CVE-2023-53240}
firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers {CVE-2024-41038}
virtgpu: don't reset on shutdown {CVE-2025-38064}
xen/netfront: fix crash when removing device {CVE-2022-48969}
mptcp: do not fallback when OoO is present {CVE-2024-50185}
can: j1939: add missing calls in NETDEV_UNREGISTER notification handler {CVE-2025-39925}
netfilter: nf_tables: remove redundant chain validation on register store {CVE-2025-71160}
xfs: fix use-after-free in xattr node block inactivation {CVE-2026-43053}
ext4: fix racy may inline data check in dio write {CVE-2023-52786}
drm/amdgpu/fence: Fix oops due to non-matching drm_sched init/fini {CVE-2023-52738}
macsec: fix UAF bug for real_dev {CVE-2022-49390}
drm/i915/gem: Fix Virtual Memory mapping boundaries calculation {CVE-2024-42259}
mm/shmem: disable PMD-sized page cache if needed {CVE-2024-42241}
driver: iio: add missing checks on iio_info's callback access {CVE-2024-46715}
udmabuf: fix memory leak on last export_udmabuf() error path {CVE-2024-56712}
ALSA: control: Avoid WARN() for symlink errors {CVE-2024-56657}
mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM {CVE-2024-56611}
eth: bnxt: always recalculate features after XDP clearing, fix null-deref {CVE-2025-21682}
net: annotate data-races around sk->sk_{data_ready,write_space} {CVE-2026-23302}
udmabuf: change folios array from kmalloc to kvmalloc {CVE-2024-56544}
RDMA/mlx5: Move events notifier registration to be after device registration {CVE-2024-53224}
dlm: fix possible lkb_resource…

Record: CLSA-2026-1783791447
Updated: 2026-11-02

OSV No score

serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN

In the Linux kernel, the following vulnerability has been resolved:

serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN

uart_write_room() and uart_write() behave inconsistently when xmit_buf is NULL (which happens for PORT_UNKNOWN ports that were never properly initialized):

uart_write_room() returns kfifo_avail() which can be > 0
uart_write() checks xmit_buf and returns 0 if NULL

This inconsistency causes an infinite loop in drivers that rely on tty_write_room() to determine if they can write:

while (tty_write_room(tty) > 0) { written = tty->ops->write(...); // written is always 0, loop never exits }

For example, caif_serial's handle_tx() enters an infinite loop when used with PORT_UNKNOWN serial ports, causing system hangs.

Fix by making uart_write_room() also check xmit_buf and return 0 if it's NULL, consistent with uart_write().

Reproducer: https://gist.github.com/mrpre/d9a694cc0e19828ee3bc3b37983fde13

Record: CVE-2026-23472
Updated: 2026-11-07

OSVopenSUSE-SU-2026:20826-1 No score