{"api_version":"1","generated_at":"2026-09-18T17:56:37+00:00","cve":"CVE-2026-93123","urls":{"html":"https://cve.report/CVE-2026-93123","api":"https://cve.report/api/cve/CVE-2026-93123.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-93123","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-93123"},"summary":{"title":"serial: qcom-geni: do not advance stale DMA completions","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nserial: qcom-geni: do not advance stale DMA completions\n\nThe qcom GENI serial DMA TX completion path advances the transmit fifo by\nthe number of bytes recorded in port->tx_remaining.\n\nIf uart_flush_buffer() runs after the hardware has completed a DMA\ntransfer but before the DMA completion interrupt has been handled, the\nserial core resets the transmit fifo while port->tx_remaining still\ndescribes the old DMA transfer.\n\nA previous fix avoided advancing an empty fifo by checking that the fifo\nlength is at least tx_remaining. That still does not distinguish the old\nDMA payload from new bytes written after the flush. If userspace writes\nnew data before the stale DMA completion interrupt is handled, the fifo\ncan again contain at least tx_remaining bytes and the stale completion\ncan advance and discard those new bytes.\n\nMark an in-flight DMA transfer stale when the transmit fifo is flushed.\nThe later completion still unprepares the original DMA mapping using the\nsaved length, but it no longer advances the transmit fifo.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-09-17 17:18:07","updated_at":"2026-09-17 17:18:07"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/59faa59c25a0a098fbc86275408d7c8405015702","name":"https://git.kernel.org/stable/c/59faa59c25a0a098fbc86275408d7c8405015702","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/231c84fe7ec40e4a06c398c0591d5b8e823d68e1","name":"https://git.kernel.org/stable/c/231c84fe7ec40e4a06c398c0591d5b8e823d68e1","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/c02d030747c46da33faf406dd772ef91100efa27","name":"https://git.kernel.org/stable/c/c02d030747c46da33faf406dd772ef91100efa27","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/7ea38c49e7178960926657863299face6dc0e1b0","name":"https://git.kernel.org/stable/c/7ea38c49e7178960926657863299face6dc0e1b0","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93123","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93123","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2aaa43c7077833301c237684cd7bc9ae5e3dec95 231c84fe7ec40e4a06c398c0591d5b8e823d68e1 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2aaa43c7077833301c237684cd7bc9ae5e3dec95 c02d030747c46da33faf406dd772ef91100efa27 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2aaa43c7077833301c237684cd7bc9ae5e3dec95 59faa59c25a0a098fbc86275408d7c8405015702 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2aaa43c7077833301c237684cd7bc9ae5e3dec95 7ea38c49e7178960926657863299face6dc0e1b0 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.3","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.3 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.110 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.52 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.6 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3-rc1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/tty/serial/qcom_geni_serial.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"231c84fe7ec40e4a06c398c0591d5b8e823d68e1","status":"affected","version":"2aaa43c7077833301c237684cd7bc9ae5e3dec95","versionType":"git"},{"lessThan":"c02d030747c46da33faf406dd772ef91100efa27","status":"affected","version":"2aaa43c7077833301c237684cd7bc9ae5e3dec95","versionType":"git"},{"lessThan":"59faa59c25a0a098fbc86275408d7c8405015702","status":"affected","version":"2aaa43c7077833301c237684cd7bc9ae5e3dec95","versionType":"git"},{"lessThan":"7ea38c49e7178960926657863299face6dc0e1b0","status":"affected","version":"2aaa43c7077833301c237684cd7bc9ae5e3dec95","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/tty/serial/qcom_geni_serial.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.3"},{"lessThan":"6.3","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.110","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.52","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3-rc1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.110","versionStartIncluding":"6.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.52","versionStartIncluding":"6.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.6","versionStartIncluding":"6.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3-rc1","versionStartIncluding":"6.3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nserial: qcom-geni: do not advance stale DMA completions\n\nThe qcom GENI serial DMA TX completion path advances the transmit fifo by\nthe number of bytes recorded in port->tx_remaining.\n\nIf uart_flush_buffer() runs after the hardware has completed a DMA\ntransfer but before the DMA completion interrupt has been handled, the\nserial core resets the transmit fifo while port->tx_remaining still\ndescribes the old DMA transfer.\n\nA previous fix avoided advancing an empty fifo by checking that the fifo\nlength is at least tx_remaining. That still does not distinguish the old\nDMA payload from new bytes written after the flush. If userspace writes\nnew data before the stale DMA completion interrupt is handled, the fifo\ncan again contain at least tx_remaining bytes and the stale completion\ncan advance and discard those new bytes.\n\nMark an in-flight DMA transfer stale when the transmit fifo is flushed.\nThe later completion still unprepares the original DMA mapping using the\nsaved length, but it no longer advances the transmit fifo."}],"providerMetadata":{"dateUpdated":"2026-09-17T16:11:28.552Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/231c84fe7ec40e4a06c398c0591d5b8e823d68e1"},{"url":"https://git.kernel.org/stable/c/c02d030747c46da33faf406dd772ef91100efa27"},{"url":"https://git.kernel.org/stable/c/59faa59c25a0a098fbc86275408d7c8405015702"},{"url":"https://git.kernel.org/stable/c/7ea38c49e7178960926657863299face6dc0e1b0"}],"title":"serial: qcom-geni: do not advance stale DMA completions","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-93123","datePublished":"2026-09-17T16:11:28.552Z","dateReserved":"2026-09-17T16:02:15.086Z","dateUpdated":"2026-09-17T16:11:28.552Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-17 17:18:07","lastModifiedDate":"2026-09-17 17:18:07","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"93123","Ordinal":"1","Title":"serial: qcom-geni: do not advance stale DMA completions","CVE":"CVE-2026-93123","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"93123","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nserial: qcom-geni: do not advance stale DMA completions\n\nThe qcom GENI serial DMA TX completion path advances the transmit fifo by\nthe number of bytes recorded in port->tx_remaining.\n\nIf uart_flush_buffer() runs after the hardware has completed a DMA\ntransfer but before the DMA completion interrupt has been handled, the\nserial core resets the transmit fifo while port->tx_remaining still\ndescribes the old DMA transfer.\n\nA previous fix avoided advancing an empty fifo by checking that the fifo\nlength is at least tx_remaining. That still does not distinguish the old\nDMA payload from new bytes written after the flush. If userspace writes\nnew data before the stale DMA completion interrupt is handled, the fifo\ncan again contain at least tx_remaining bytes and the stale completion\ncan advance and discard those new bytes.\n\nMark an in-flight DMA transfer stale when the transmit fifo is flushed.\nThe later completion still unprepares the original DMA mapping using the\nsaved length, but it no longer advances the transmit fifo.","Type":"Description","Title":"serial: qcom-geni: do not advance stale DMA completions"}]}}}