CVE-2026-64528: 
Linux Debian Analisi e mitigazione delle vulnerabilità

CVE-2026-64528 is a deadlock vulnerability in the Linux kernel's Samsung serial (s3c24xx) TTY driver that can cause a kernel hang when console flow control is enabled. The flaw was introduced at commit b497549a035c and affects Linux kernel versions from 2.6.27 up to (but not including) the patched stable releases. Fixed versions include 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, and 7.1. It carries an estimated CVSS severity of Medium and an EPSS score of approximately 0.22% (GitHub Advisory, Feedly).

The root cause is a deadlock (CWE-833: Deadlock) caused by redundant, non-recursive spinlock acquisition in the Samsung serial driver. When console flow control (UPF_CONS_FLOW) is enabled, s3c24xx_serial_stop_tx() calls s3c24xx_serial_rx_enable() and s3c24xx_serial_start_tx() calls s3c24xx_serial_rx_disable(). Both of these rx helper functions unconditionally attempt to re-acquire port->lock via uart_port_lock_irqsave(), but the serial core framework and all internal driver paths (e.g., DMA TX completion handler s3c24xx_serial_tx_dma_complete(), PIO TX IRQ handler s3c24xx_serial_tx_irq()) already hold port->lock when invoking the TX callbacks. Since Linux spinlocks are not recursive, this causes the same CPU to deadlock. The fix removes the redundant lock acquisition from both s3c24xx_serial_rx_enable() and s3c24xx_serial_rx_disable() (GitHub Advisory).

Successful exploitation results in a kernel deadlock on the CPU handling the Samsung serial port, rendering the affected system completely unresponsive (Denial of Service). There is no confidentiality or integrity impact — the vulnerability is limited to availability. The scope is confined to systems using Samsung s3c24xx-compatible serial hardware with console flow control enabled, which is primarily embedded Linux platforms (e.g., older Samsung SoC-based boards) (GitHub Advisory, Feedly).

Apply the upstream kernel patches that remove the redundant uart_port_lock_irqsave() calls from s3c24xx_serial_rx_enable() and s3c24xx_serial_rx_disable(). Patched stable kernel versions are: 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, and 7.1. As a temporary workaround, disabling console flow control (UPF_CONS_FLOW) in the serial driver configuration will prevent the deadlock condition from being triggered (GitHub Advisory).