Skip to main content

Linux EUVDEUVD-2026-18745

| CVE-2026-23472 MEDIUM
Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)
2026-04-03 Linux
Denial Of Service Linux
5.5
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-835
ASVS 5.0
V15 - Secure Coding and Architecture Loop termination conditions
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Impact

This vulnerability presents a moderate but concrete denial of service risk primarily affecting systems using serial drivers with specific initialization patterns (PORT_UNKNOWN ports). The attack vector is local and does not require special privileges-any process that can initiate serial I/O on an uninitialized port can trigger the infinite loop. While CVSS and EPSS scores are unavailable (kernel-specific vulnerability), the practical risk is elevated for systems relying on caif_serial (connectivity abstraction interface) or custom serial drivers that depend on tty_write_room() for flow control. The kernel maintainers assigned moderate priority (evidenced by the fix being applied to stable branches). The vulnerability is neither remotely exploitable nor authenticated-attack-based; it requires local access to serial port interfaces. The availability of a reproducer (gist) confirms the issue is technically reproducible but does not indicate active widespread exploitation.
Exploit ScenarioDerived

A system administrator or user with access to serial port configuration on a Linux system running an older kernel can trigger the infinite loop by attempting to write data to an uninitialized serial port (PORT_UNKNOWN state) using caif_serial driver or similar serial I/O drivers. The infinite loop in handle_tx() causes the kernel to enter an uninterruptible busy-wait state, consuming CPU and potentially hanging the affected process or kernel thread, resulting in system degradation or complete unavailability. No special exploit code or privilege escalation is required-the condition occurs naturally when serial port initialization is incomplete or when certain serial device configuration sequences are performed.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAI

Infinite loop in Linux kernel serial core driver handle_tx() affects systems using uninitialized PORT_UNKNOWN serial ports, where uart_write_room() and uart_write() behave inconsistently regarding null transmit buffers, causing denial of service through system hangs. The vulnerability impacts caif_serial and other drivers that rely on tty_write_room() to determine write capacity. Patch available in upstream kernel commits; no CVSS score assigned due to kernel-specific nature and relatively limited exposure scope.

RemediationAI

Vendor-released patch: kernel commit efe85a557186b7fe915572ae93a8f3f78bfd9a22 (and backports bc70f2b36cf474d5cc8ecbcaf57f3e326fdec67c, 455ce986fa356ff43a43c0d363ba95fa152f21d5) resolves the issue by modifying uart_write_room() to check xmit_buf and return 0 if NULL, making behavior consistent with uart_write(). Systems administrators should update to a kernel version containing the referenced commit from git.kernel.org/stable. Interim workarounds include avoiding serial I/O operations on uninitialized PORT_UNKNOWN ports or implementing explicit state validation in calling drivers prior to write operations. Full patch details and stable kernel versions containing the fix are available at the referenced git.kernel.org stable commits.

Affected VersionsENISA

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <455ce986fa356ff43a43c0d363ba95fa152f21d5
Linux patch: 6.18.20
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <bc70f2b36cf474d5cc8ecbcaf57f3e326fdec67c
Linux patch: 7.0-rc5
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <efe85a557186b7fe915572ae93a8f3f78bfd9a22
Linux patch: 6.19.10

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The Linux kernel serial core (drivers/tty/serial/serial_core.c) provides uart_write_room() and uart_write() functions that interact with the transmit FIFO buffer (xmit_buf). When a serial port is in PORT_UNKNOWN state (uninitialized), xmit_buf remains NULL. The root cause is a logic inconsistency: uart_write_room() invokes kfifo_avail() which returns available FIFO space even when xmit_buf is NULL, while uart_write() explicitly checks for NULL xmit_buf and returns 0 bytes written. This inconsistency (CWE-835: Infinite Loop) causes callers in higher-level drivers like caif_serial to enter infinite loops when checking write availability. The underlying issue stems from inadequate state validation in the tty layer's write path for uninitialized serial ports.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE MEDIUM
Red Hat 5.5 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
CVSS changed
May 26, 2026 - 14:37 NVD
5.5 (MEDIUM)
Patch available
Apr 16, 2026 - 05:29 EUVD
455ce986fa356ff43a43c0d363ba95fa152f21d5
CVE Published
Apr 03, 2026 - 15:15 nvd
N/A

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN

uart_write_room() and uart_write() behave inconsistently when xmit_buf is NULL (which happens for PORT_UNKNOWN ports that were never properly initialized):

  • uart_write_room() returns kfifo_avail() which can be > 0
  • uart_write() checks xmit_buf and returns 0 if NULL

This inconsistency causes an infinite loop in drivers that rely on tty_write_room() to determine if they can write:

while (tty_write_room(tty) > 0) { written = tty->ops->write(...); // written is always 0, loop never exits }

For example, caif_serial's handle_tx() enters an infinite loop when used with PORT_UNKNOWN serial ports, causing system hangs.

Fix by making uart_write_room() also check xmit_buf and return 0 if it's NULL, consistent with uart_write().

Reproducer: https://gist.github.com/mrpre/d9a694cc0e19828ee3bc3b37983fde13

Threat Intelligence Overview

EPSS Score
0.0%
Top 96% exploitable
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Same weakness CWE-835 – Loop with Unreachable Exit Condition (Infinite Loop)

View all
CVE-2024-20353 HIGH POC
8.6
CVE-2020-13935 HIGH POC
7.5
CVE-2017-16944 HIGH POC
7.5
CVE-2023-34966 HIGH
7.5
CVE-2022-0778 HIGH POC
7.5
CVE-2024-43366 CRITICAL POC
9.1
CVE-2026-25533 HIGH POC
8.8
CVE-2018-8002 HIGH POC
8.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.145 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.132 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.162 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.132 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.176 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.125 Affected
Image SLES-Azure-Basic Image SLES-EC2 Image SLES-Hardened-BYOS-Azure Image SLES-SAPCAL-Azure Affected
Image SLES12-SP5-Azure-BYOS Image SLES12-SP5-EC2-BYOS Image SLES12-SP5-EC2-ECS-On-Demand Image SLES12-SP5-EC2-On-Demand Image SLES12-SP5-GCE-BYOS Image SLES12-SP5-GCE-On-Demand Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-23472 ADVISORY https://vuldb.com/vuln/355140 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2068/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21834/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21841/ REF https://git.kernel.org/stable/c/455ce986fa356ff43a43c0d363ba95fa152f21d5 REF https://git.kernel.org/stable/c/91c2a5d201daf66fa3f42b8a383bb89174bde2c8 REF https://git.kernel.org/stable/c/bc70f2b36cf474d5cc8ecbcaf57f3e326fdec67c REF https://git.kernel.org/stable/c/c9e845014723d552944cec4e146ec7b841cda34d REF https://git.kernel.org/stable/c/d45cfa70bf0159afb31cb03d2d16ec5a5053460c REF https://git.kernel.org/stable/c/efe85a557186b7fe915572ae93a8f3f78bfd9a22

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy