Linux Kernel DMA Teardown Race Condition in Serial Driver

CVE-2026-80737 is a race condition vulnerability in the Linux kernel's AMBA PL011 serial driver that occurs during DMA (Direct Memory Access) resource cleanup. The vulnerability exists because the driver uses dmaengine_terminate_all(), which does not synchronously wait for active DMA callbacks to complete before freeing associated buffers. This creates a window where TX callbacks can access freed memory, and RX poll timers can read buffers without proper locking. This affects any Linux system using the PL011 serial controller—commonly found in embedded systems, IoT devices, and ARM-based infrastructure. An attacker with local access could potentially trigger use-after-free conditions, leading to information disclosure, denial of service, or privilege escalation.

While this CVE lacks mapped MITRE ATT&CK techniques and Casky skills in the current database, practitioners would detect exploitation attempts by monitoring for patterns consistent with CWE-416 (Use After Free) and CWE-362 (Concurrent Access to Shared Resource). Casky's extended reasoning capabilities would help identify suspicious kernel memory access patterns, unexpected serial driver crashes, or memory corruption artifacts in crash dumps. Security teams should focus on detecting T1499 (Endpoint Denial of Service) through serial driver faults, T1005 (Data from Local System) attempts exploiting memory disclosure, and T1548 (Abuse Elevation Control Mechanism) chains that follow successful heap corruption. Mitigation requires applying kernel patches that switch to dmaengine_terminate_sync() with proper timer cleanup—a configuration change practitioners should validate in their infrastructure inventory.