CVE-2026-80886: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-80886 is a race condition vulnerability in the Linux kernel's MSM (Qualcomm) serial driver (serial: msm) that can cause the kernel console to enter an infinite output loop. When userspace and the kernel concurrently write to the console UART, a timing conflict between asynchronous DMA transfers and PIO reconfiguration results in the DMA engine reporting zero progress, causing the same messages to be printed repeatedly. The vulnerability affects Linux kernel versions from 4.4 up to (but not including) the patched stable releases. It was published on September 4, 2026, with a CVSS base score of 0.0 and an estimated medium severity (GitHub Advisory, Feedly).

The root cause is a race condition (CWE-362) in the MSM serial driver's handling of concurrent console writes. When userspace writes to the TTY device, the driver initiates an asynchronous DMA transfer and releases the port lock; simultaneously, the kernel's printk path can acquire the port lock and reconfigure the UART controller for PIO mode without waiting for the DMA operation to complete. This collision causes the DMA engine to report zero progress, resulting in an infinite loop of repeated console output. The fix disables DMA for the console UART instance in the MSM driver, consistent with the approach taken in other serial drivers such as 8250_port.c, imx.c, and sh-sci.c (GitHub Advisory).

Successful exploitation results in a Denial of Service (DoS) affecting the availability of the kernel console — the console enters an infinite loop printing the same messages, rendering normal console output unusable. This is most likely to occur during system startup or shutdown when many services interact with kernel code simultaneously. There is no evidence of confidentiality or integrity impact; the vulnerability is limited to availability of console output (GitHub Advisory, Feedly).

No public proof-of-concept exploit is known, and there is no evidence of in-the-wild exploitation as of the publication date (GitHub Advisory). The vulnerability requires local access — specifically, write access to the TTY console device — making remote exploitation infeasible without prior access. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

The Linux kernel has been patched across multiple stable branches. Unaffected (patched) versions include 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2+. Administrators should upgrade to one of these patched kernel versions. As a temporary workaround, restricting write access to the TTY console device to authorized users only can reduce the likelihood of triggering the race condition from userspace (GitHub Advisory, Feedly).