Cloudanix VulnDB

CVE-2026-80886

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in certain Linux systems can cause the console to get stuck printing the same messages forever when the system is starting up or shutting down.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Race condition in msm serial driver allows concurrent userspace DMA writes and kernel printk PIO reconfiguration to the console UART, causing the DMA engine to report zero progress and enter an infinite loop repeating the same console messages.

Why it matters to the business

Systems may become unresponsive or produce excessive console output during boot or shutdown when many services start or stop, leading to operational delays, difficult debugging, and potential service outages in environments relying on serial consoles.

How an attack unfolds

An attacker with local access writes to the TTY device while the kernel is printing messages during startup or shutdown; the resulting collision between DMA and PIO paths triggers the infinite console loop without requiring any special privileges beyond normal userspace TTY access.

How to fix it

Apply the upstream kernel patch that disables DMA for the kernel console UART instance; rebuild and deploy the updated kernel across affected systems.

How to confirm the fix worked

Confirm the msm serial driver source contains the added check that skips DMA for the console UART; test by initiating concurrent userspace and printk activity and verifying console output remains stable without repetition loops.

Typical attack path

  1. Obtain local shell or process execution on the target system
  2. Trigger high-volume service start/stop activity (e.g., during boot or init scripts)
  3. Perform concurrent writes to the console TTY device while kernel printk is active
  4. Observe repeated identical console messages indicating the race has been triggered

How to detect it

Inspect serial console logs and dmesg output for long sequences of identical repeated messages during boot or service startup; correlate with periods of high init activity or userspace TTY writes.

  • repeated identical console message blocks spanning multiple seconds
  • console output showing the same printk string in an unbroken loop

What your security team should do

  • Prioritize patching kernel images that use msm serial consoles on embedded or server platforms
  • Monitor for repeated console output patterns during maintenance windows
  • Review any downstream distributions or embedded products that carry this msm driver code

The record

In the Linux kernel, the following vulnerability has been resolved: serial: msm: Disable DMA for kernel console UART At the moment, concurrent writes from userspace and the kernel to the console can trigger a race condition that results in an infinite loop of the same messages printed over and over again. This is most likely to happen during system startup or shutdown when the init system starts/stops a large number of system services that interact with various kernel code. When userspace writes to the TTY device, the driver initiates an asynchronous DMA transfer and releases the port lock. At the same moment, the kernel printk path might grab the port lock and re-configure the UART controller for PIO, without waiting for the DMA operation to complete. It seems like this collision results in zero progress being reported for the DMA engine, so the same text is printed to the console over and over again. For the kernel console, we want a reliable output path that will be functional even during crashes etc. So rather than implementing complex code to synchronize the kernel console write routines with the userspace DMA write routines, simply disable DMA for the console UART instance. Similar checks exist in many other serial drivers, e.g. 8250_port.c, imx.c, sh-sci.c etc.

Affected packages

Ecosystem Package Introduced Fixed