CVE-2026-23472: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23472 is a denial-of-service vulnerability in the Linux kernel's serial core driver caused by an infinite loop condition in handle_tx() for PORT_UNKNOWN serial ports. The flaw arises from inconsistent behavior between uart_write_room() and uart_write() when xmit_buf is NULL, affecting Linux kernel versions from 2.6.12 through 6.18.x (fixed in 6.18.20) and 6.19.x (fixed in 6.19.10), as well as pre-release 7.0 builds up to rc4. It was published on April 3, 2026, with patches released by May 26, 2026. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) (Github Advisory, Feedly).

The root cause is classified as CWE-835 (Loop with Unreachable Exit Condition / Infinite Loop). When a PORT_UNKNOWN serial port is never properly initialized, xmit_buf remains NULL; uart_write_room() incorrectly returns kfifo_avail() (which can be greater than 0), while uart_write() correctly checks for NULL and returns 0. Drivers such as caif_serial that use a while (tty_write_room(tty) > 0) pattern will loop indefinitely because the write call always returns 0 bytes written, causing a kernel hang. The fix makes uart_write_room() also check xmit_buf and return 0 if NULL, aligning its behavior with uart_write(). A public reproducer is available at https://gist.github.com/mrpre/d9a694cc0e19828ee3bc3b37983fde13 (Github Advisory).

Successful exploitation causes a complete system hang (kernel infinite loop), resulting in a full denial of service with high availability impact. There is no confidentiality or integrity impact, as the vulnerability only affects system availability. A local user with low privileges can trigger the hang by interacting with an uninitialized PORT_UNKNOWN serial port, potentially affecting all processes and services running on the system (Github Advisory, Feedly).

1. Identify a vulnerable system: Confirm the target is running a Linux kernel version between 2.6.12 and 6.18.19, or 6.19.0 through 6.19.9, with the caif_serial driver or another driver that uses a tty_write_room()-based write loop.
2. Access a local shell: Obtain a low-privileged local user account on the target system (no root or special privileges required).
3. Trigger use of a PORT_UNKNOWN serial port: Interact with or open an uninitialized PORT_UNKNOWN serial port (one where xmit_buf is NULL), for example by sending data through a CAIF serial interface configured to use such a port.
4. Induce the infinite loop: Initiate a write operation through the affected driver (e.g., caif_serial's handle_tx()). Because uart_write_room() returns a non-zero value but uart_write() always returns 0, the driver's write loop never exits.
5. System hang achieved: The kernel enters an infinite loop, consuming CPU and causing the system to become unresponsive, resulting in a denial of service (Github Advisory, Feedly).

• Logs: Kernel logs (dmesg) showing the system becoming unresponsive or soft lockup warnings related to serial/CAIF driver threads; absence of new log entries after a certain point indicating a hang.
• Process: A kernel thread (e.g., associated with caif_serial or a similar serial driver) consuming 100% CPU as observed via top or ps, with no forward progress.
• System Behavior: Complete system unresponsiveness or inability to schedule new processes, consistent with a kernel-level infinite loop; watchdog timer expiration messages if a hardware watchdog is present.

Update the Linux kernel to version 6.18.20 or later (for kernels in the 2.6.12–6.18.x range) or 6.19.10 or later (for 6.19.x kernels); the fix is also included in 7.0-rc5 for development builds. The patches are available at the official kernel stable tree commits: 455ce986, bc70f2b3, and efe85a55. As a workaround where patching is not immediately possible, restrict local user access to serial port devices and disable or unload the caif_serial module if it is not required. Distribution-specific updates are available from SUSE (SUSE-SU-2026:2068-1, SUSE-SU-2026:2217-1, SUSE-SU-2026:2238-1) and Amazon Linux 2023 (ALAS2023-2026-1596) (Github Advisory, Feedly).

The vulnerability was announced via the Linux kernel CVE mailing list (lore.kernel.org) on April 3, 2026, and subsequently tracked by Yocto Project security advisories and multiple distribution vendors including SUSE and Amazon Linux. Nessus (Tenable) and Qualys have both released detection plugins for this CVE. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability tracking (Feedly).