97 matches found
CVE-2026-80737 serial: amba-pl011: synchronize DMA teardown
In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: synchronize DMA teardown dmaengineterminateall does not wait for a running callback, so the TX callback can still touch the TX buffer after it is freed. The RX poll timer reads the RX buffers without the port...
EUVD-2026-70341
In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: synchronize DMA teardown dmaengineterminateall does not wait for a running callback, so the TX callback can still touch the TX buffer after it is freed. The RX poll timer reads the RX buffers without the port...
CVE-2026-80737 serial: amba-pl011: synchronize DMA teardown
In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: synchronize DMA teardown dmaengineterminateall does not wait for a running callback, so the TX callback can still touch the TX buffer after it is freed. The RX poll timer reads the RX buffers without the port...
CVE-2026-80737
This vulnerability affects the amba-pl011 UART driver in the Linux kernel . During DMA teardown, dmaengine_terminate_all() does not wait for a running callback, allowing the TX callback to access the TX buffer after it has been freed (use-after-free). Additionally, the RX poll timer reads RX buff...
PT-2026-84935
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the amba-pl011 serial driver regarding DMA teardown synchronization. The function dmaengine terminate all fails to wait for active callbacks, which allows the TX...
CVE-2026-80737: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: synchronize DMA teardown dmaengineterminateall does not wait for a running callback, so the TX callback can still touch the TX buffer after it is freed. The RX poll timer reads the RX buffers without the port...
PT-2026-90884
In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: synchronize DMA teardown dmaengine terminate all does not wait for a running callback, so the TX callback can still touch the TX buffer after it is freed. The RX poll timer reads the RX buffers without the por...
CVE-2026-80737: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: synchronize DMA teardown dmaengineterminateall does not wait for a running callback, so the TX callback can still touch the TX buffer after it is freed. The RX poll timer reads the RX buffers without the port...
The vulnerability of the amba_device_release() function in the drivers/amba/bus.c module of the Linux kernel allows a hacker to cause a service failure.
The vulnerability of the ambadevicerelease function in the drivers/amba/bus.c module of the Linux kernel is related to errors during link counters updates. Exploiting this vulnerability could allow an attacker to cause a service failure...
SUSE CVE-2026-74652
In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ The RS485 trigger hrtimers are embedded in the devm-managed port and can fire after it is freed. The IRQ handler can arm a timer, so free the IRQ first and then cancel...
CVE-2026-74652
A flaw was found in the Linux kernel's amba-pl011 serial driver. The RS485 trigger high-resolution timers hrtimers can fire after the device management devm-managed port is freed. This occurs because the timers are not properly canceled before the interrupt request IRQ is freed, allowing a...
CVE-2026-74652
In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ The RS485 trigger hrtimers are embedded in the devm-managed port and can fire after it is freed. The IRQ handler can arm a timer, so free the IRQ first and then cancel...
UBUNTU-CVE-2026-74652
In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ The RS485 trigger hrtimers are embedded in the devm-managed port and can fire after it is freed. The IRQ handler can arm a timer, so free the IRQ first and then cancel...
CVE-2026-74652
In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ The RS485 trigger hrtimers are embedded in the devm-managed port and can fire after it is freed. The IRQ handler can arm a timer, so free the IRQ first and then cancel...
CVE-2026-74652 serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ
In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ The RS485 trigger hrtimers are embedded in the devm-managed port and can fire after it is freed. The IRQ handler can arm a timer, so free the IRQ first and then cancel...
CVE-2026-74652
A use-after-free vulnerability in the Linux kernel's amba-pl011 serial driver affects the RS485 trigger high-resolution timers (hrtimers). These timers are embedded in the devm-managed port and can fire after the port is freed, because the IRQ handler may arm a timer before the timers are cancele...
EUVD-2026-64589
In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ The RS485 trigger hrtimers are embedded in the devm-managed port and can fire after it is freed. The IRQ handler can arm a timer, so free the IRQ first and then cancel...
CVE-2026-74652 serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ
In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ The RS485 trigger hrtimers are embedded in the devm-managed port and can fire after it is freed. The IRQ handler can arm a timer, so free the IRQ first and then cancel...
CVE-2026-74652: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ The RS485 trigger hrtimers are embedded in the devm-managed port and can fire after it is freed. The IRQ handler can arm a timer, so free the IRQ first and then cancel...
PT-2026-79657
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the amba-pl011 serial driver where RS485 trigger hrtimers high-resolution timers are embedded in the devm-managed port and may fire after the port has been freed...