{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.94-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.0.12-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ  When uart_flush_buffer() runs before the DMA completion IRQ is delivered, the following race can occur (all steps serialized by uart_port_lock):    1. DMA starts: tx_remaining = N, kfifo contains N bytes   2. DMA completes in hardware; IRQ is pending but not yet delivered   3. uart_flush_buffer() acquires the port lock and calls kfifo_reset(),      making kfifo_len() = 0 while tx_remaining remains N   4. uart_flush_buffer() releases the port lock   5. DMA IRQ fires; handle_tx_dma() acquires the port lock and calls      uart_xmit_advance(uport, tx_remaining) on an empty kfifo  uart_xmit_advance() increments kfifo-\u003eout by tx_remaining. Since kfifo_reset() already set both in and out to 0, out wraps past in, causing kfifo_len() to return UART_XMIT_SIZE - tx_remaining. The next start_tx_dma() call then submits a DMA transfer of stale buffer data.  Fix this by snapshotting kfifo_len() at the start of handle_tx_dma() and skipping uart_xmit_advance() when fifo_len \u003c tx_remaining, which indicates the kfifo was reset by a preceding flush.",
  "id": "DEBIAN-CVE-2026-63883",
  "modified": "2026-09-14T16:47:30.373424487Z",
  "published": "2026-07-19T16:17:05.343Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-63883"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-63883"
  ]
}